FEDEX Ship Manager

[Gadgetgeek2000]

Following files were found on the FEDEX Ship Manager server installation, version 3508:

C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-api-2.8.2.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-core-2.8.2.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-jcl-2.8.2.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-slf4j-impl-2.8.2.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4jna-api-2.0.jar

[Gadgetgeek2000]

Downloading and installing the latest 3509. Will test again following.
Update

[Gadgetgeek2000]

The Log4J files are updated by the latest installation version 3509.
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-api-2.16.0.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-core-2.16.0.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-jcl-2.16.0.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-slf4j-impl-2.16.0.jar
C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4jna-api-2.0.jar

However, the log4j-core-2.16.0.jar is listed as vulnerable CVE CVE-2021-45105.
JNDILocation: org/apache/logging/log4j/core/lookup/JndiLookup.class

[maertsen]

hi @Gadgetgeek2000, thanks for your research. Would you mind submitting a PR? Have a look at https://docs.github.com/en/repositories/working-with-files/managing-files/editing-files#editing-files-in-another-users-repository if this is new for you.

[Gadgetgeek2000]

I'm not very familiar with Github but I'll check it out.

[Gadgetgeek2000]

Just got word from my rep:

The FSM (Fedex Ship Manager) 3510 PLC version tentatively due for release on 1/24 contains the Log4j version 2.17.