0

I'm running a PowerDNS on Linux. It looks like PowerDNS is vulnerable to the new log4j-exploit. Is there any way I can disable the Log4j? From my research it looks like you can change the logging method to syslog, but I'm not quite sure on how to do that.

Halsi
  • 87
  • 1
  • 5
  • 4
    Why should PowerDNS be vulnerable? It can't contain Log4j, it's not even written in Java. – Gerald Schneider Dec 13 '21 at 09:01
  • https://help.internetx.com/pages/viewpage.action?pageId=26515072 They write about how they use log4j at "Configuration of the Logging" – Halsi Dec 13 '21 at 09:37
  • 2
    That's not PowerDNS, that's a different component. You should clarify that your question is about the REST component, not PowerDNS itself. – Gerald Schneider Dec 13 '21 at 09:42

1 Answers1

2

PowerDNS is written in C++, not Java. PowerDNS does not use Log4J.

However, you should always check where your logs go. It is possible that somewhere down the line (for example, in Elasticsearch) they do hit Log4J.

I wrote a blog post about this.

Habbie
  • 755
  • 3
  • 9