log4j is showing up in our security scans under the default python install:C:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\Lib\site-packages\saspy\java\iomclientDoes this fall under the ESRI response for pro:Recent releases of ArcGIS Pro contain Log4j but are not known to be exploitable as the software does not listen for remote traffic.Is there any concern in removing this package from our user base install? Our security team is not happy with the ESRI response and want this removed.
Caveat - I do not work for Esri Software are Security Team rather Training Services: I found this blog article addressing log4j - ArcGIS and Apache Log4j Vulnerabilities (esri.com)
Hope this helps.
Les membres connectés peuvent publier, suivre les mises à jour, et plus encore. Nouveau ici ? Inscrivez-vous gratuitement.
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.
