[Resolved] log4j Vulnerability

Mon, 13 Dec 2021 15:00:00 +0000

Update

At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.

Original Post

Multiple vulnerabilities (CVE-2021-44228 and CVE-2021-45046) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 or CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.

Please note these lists apply to the stated version tags and later only. If you are running older versions of the images they may still be vulnerable.

Fleet - version-2.3.2 and later (Workaround applied + upstream fix)
Airsonic (No log4j-core in use)
HABridge (No log4j-core in use)
Unifi Controller - version-6.5.55 and later (Workaround applied + upstream fix)
Davos version-2.2.2 and later (Upstream fix)
Booksonic Air - version-v2112.2.0 and later (Upstream fix)

The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.

Unifi Controller - version-6.5.54 and later (Workaround applied + upstream fix)
Booksonic Air - version-v2112.1.0 and later (Upstream fix)
nzbhydra2 - version-v3.18.4 and later (Upstream fix)

The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.

Booksonic (Deprecated)

The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java-based and so may be using log4j in some capacity.

Ubooquity

We will update this post as more information becomes available.

New Container: Habridge

Sun, 08 Apr 2018 00:00:00 +0000

We have released a new container for Habridge!

Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as “On”, “Off” and “brightness” commands of the hue protocol. This bridge can control most devices that have a distinct API.

In the cases of systems that require authorization and/or have APIs that cannot be handled in the current method, a module may need to be built. The Harmony Hub is such a module and so is the Nest module. The Bridge has helpers to build devices for the gateway for the Logitech Harmony Hub, Vera, Vera Lite or Vera Edge, Nest, Somfy Tahoma, Home Assistant, Domoticz, MQTT, HAL, Fibaro, HomeWizard, LIFX, OpenHAB, FHEM, Broadlink and the ability to proxy all of your real Hue bridges behind this bridge.

This bridge was built to help put the Internet of Things together.

For more information about how to use this software have a look at their Wiki https://github.com/bwssytems/ha-bridge/wiki

Habridge on Info :: LinuxServer.io

[Resolved] log4j Vulnerability

Update

Original Post

New Container: Habridge