Security update about Log4Shell

security_update

What is Log4Shell?

You probably heard about Log4Shell (or CVE-2021-44228), the vulnerability which impacted log4j, a famous log library written in Java.

This critical vulnerability allows to remotely execute code on the servers of a company or to display the environment variables of an application.

What has been implemented at Clever Cloud?

At Clever Cloud, we worked all weekend to resolve this issue.

All our Elasticsearch add-ons were secured quickly, and many of our customers are secured by the most recent versions of JDK. Edit (13/12 16:41 UTC+1) : Even the most recent versions of Java are now vulnerable to RCE (Remote Code Execution) due to a bypass. The only viable solution is to patch and update log4j directly.

Please also note :

  • Java 8 (or later) users should upgrade to release 2.17.0.
  • Users requiring Java 7 should upgrade to release 2.12.2.
  • Otherwise, remove the JndiLookup class from the classpath in a post build hook (you have to execute the hook in the file where the log4j jar is):
CC_POST_BUILD_HOOK=zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class "

For the others, we have initiated a thorough monitoring and analysis policy.

We are also in the process of updating the Java image with the following Log4j configuration property: Edit (14/12 14:04 UTC+1) : The Java image has successfully be updated and all Java applications have been redeployed with the following Log4j configuration property:

log4j2.formatMsgNoLookups=true

Please note that this flag only work on versions superior or equal to Log4j v2.10.0.

We upgraded the New Relic Java Agent to the 7.4.1 version and the apps on which the agent was deployed have been redeployed.

We also patched the Pulsar cluster.

How to mitigate the risks?

We urge you to update your dependency to Log4j v2.17.0.

Then, depending on the environments and add-ons you work with, here’s what you can do as well:

For Docker

If you are using Docker, you can do either :

  • Update to Log4j v2.17.0 (recommended)
  • Or setup the following Log4j (v2.10.0 minimum only) configuration property: log4j2.formatMsgNoLookups=true

For Jenkins

The Jenkins security team has confirmed that Log4j is not used in Jenkins core. However, it can be used in some Jenkins plugins. You can identify if Log4j is included in a plugin by using the following command in the Script Console:

org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource

Support team

Of course, our support team remains available if you have any question regarding the current situation. You can reach them via the chat or send an e-mail at support@clever-cloud.com.

Blog

À lire également

Clever Cloud recognized by Gartner in its 2025 Magic Quadrant for Cloud-Native Application Platforms

Clever Cloud, a European Platform-as-a-Service (PaaS) provider, is proud to announce that it has been recognized as an Honorable Mention in Gartner’s latest Magic Quadrant for Cloud-Native Application Platforms, published on August 4, 2025.
Company Press

Developing Your Sylius Website with Monsieur Biz and Hosting it on Clever Cloud: A High-Performance Tailor-Made Solution

Sylius is an open-source e-commerce solution based on Symfony, renowned for its modularity and ability to support complex, custom architectures. Monsieur Biz specializes in building your site on Sylius, paired with high-performance hosting like Clever Cloud. Here's what you need to know.
Guests

Deploy your applications with Bun effortlessly on Clever Cloud

Bun revolutionizes the JavaScript ecosystem with its excellent performance, native TypeScript handling, and all-in-one approach. This open source alternative to Node.js/npm is gaining popularity among developers. We've streamlined its usage on Clever Cloud.
Company