title: Log4j vulnerability - Is Log4j 1.2.17 vulnerable (was unable to find any JNDI code in source)?
body: <p>With regard to the <a href="https://en.wikipedia.org/wiki/Log4j" rel="noreferrer">Log4j</a> <a href="https://en.wikipedia.org/wiki/Java_Naming_and_Directory_Interface" rel="noreferrer">JNDI</a> remote code execution vulnerability that has been identified <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228" rel="noreferrer">CVE-2021-44228</a>  - (also see references) - I wondered if <a href="https://dlcdn.apache.org/logging/log4j/1.2.17/log4j-1.2.17.zip" rel="noreferrer">Log4j-v1.2</a> is also impacted, but the closest I got from source code review is the <a href="https://github.com/kikonen/log4j-share/blob/master/src/main/java/org/apache/log4j/net/JMSAppender.java" rel="noreferrer">JMS-Appender</a>.</p>
  <p>The question is, while the posts on the Internet indicate that Log4j 1.2 is also vulnerable, I am not able to find the relevant source code for it.</p>
  <p>Am I missing something that others have identified?</p>
  <p>Log4j 1.2 appears to have a vulnerability in the <a href="https://github.com/kikonen/log4j-share/blob/master/src/main/java/org/apache/log4j/net/SocketServer.java" rel="noreferrer">socket-server</a> class, but my understanding is that it needs to be enabled in the first place for it to be applicable and hence is not a passive threat unlike the JNDI-lookup vulnerability which the one identified appears to be.</p>
  <p><em><strong>Is my understanding - that Log4j v1.2 - is not vulnerable to the jndi-remote-code execution bug correct?</strong></em></p>
  <h3>References</h3>
  <ul>
  <li><p><em><a href="https://logging.apache.org/log4j/2.x/security.html" rel="noreferrer">Apache Log4j Security Vulnerabilities</a></em></p>
  </li>
  <li><p><em><a href="https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/" rel="noreferrer">Zero-day in ubiquitous Log4j tool poses a grave threat to the Internet</a></em></p>
  </li>
  <li><p><em><a href="https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html" rel="noreferrer">Worst Apache Log4j RCE Zero day Dropped on Internet</a></em></p>
  </li>
  <li><p><em><a href="https://portswigger.net/daily-swig/log4shell-vulnerability-poses-critical-threat-to-applications-using-ubiquitous-java-logging-package-apache-log4j" rel="noreferrer">‘Log4Shell’ vulnerability poses critical threat to applications using ‘ubiquitous’ Java logging package Apache Log4j</a></em></p>
  </li>
  </ul>
  <p>This <a href="https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/" rel="noreferrer">blog post from Cloudflare</a> also indicates the same point as from <a href="https://stackoverflow.com/users/51685/akx">AKX</a>....that it was introduced from Log4j 2!</p>
  <p><strong>Update #1</strong> - A fork of the (now-retired) apache-log4j-1.2.x with patch fixes for few vulnerabilities identified in the older library is now available (from the original log4j author). The site is <a href="https://reload4j.qos.ch/" rel="noreferrer">https://reload4j.qos.ch/</a>. As of 21-Jan-2022 version 1.2.18.2 has been released. Vulnerabilities addressed to date include those pertaining to <a href="https://cve.report/CVE-2021-4104" rel="noreferrer">JMSAppender</a>, <a href="https://cve.report/CVE-2019-17571" rel="noreferrer">SocketServer</a> and <a href="https://cve.report/CVE-2022-23307" rel="noreferrer">Chainsaw</a> vulnerabilities. Note that I am simply relaying this information. Have not verified the fixes from my end. Please refer the link for additional details.</p>