log4j2

[Kabenla]

Is Scigraph affected by the log4j2 vulnerability (https://logging.apache.org/log4j/2.x/).

If so, is there an update in the works or are there any instructions on how to update the logging framework to 2.17.0?

Thank you

Kabs

[tgbugs]

I think that SciGraph services are not affected because they use log4j 1.2. OWLAPI may be affected and thus the graphloading routines could be affected, but that code is not part of software that accepts arbitrary user input. A malformed ontology file could in principle trigger the issue in OWLAPI.

All this said, I have not tested using a payload to see whether there is actually an issue.