Zero-day security vulnerability

[dadjoamc]

Bonjour à tous,
Vous avez probablement déjà entendu parler dans les médias de la vulnérabilité de sécurité de type “zero-day” appelée Log4Shell dans la bibliothèque de journalisation Java Log4j. Kobotoolbox est-il concerné par cette vulnérabilité?

Hello everyone,
You’ve probably heard in the media about the zero-day security vulnerability called Log4Shell in the Java Log4j logging library. Is Kobotoolbox affected by this vulnerability?

[Kal_Lam]

Welcome to the community, @dadjoamc! FYR here is the annoucement on the same:

Not vulnerable to the Log4Shell exploit

Hello everyone, As you may have heard, a serious security problem was recently discovered in the Log4j Java logging framework. KoBoToolbox does not use Log4j and therefore is not vulnerable to this problem. If you’d like more detail: the only part of the KoBoToolbox server software that’s written in Java is ODK Validate. ODK Validate in turn uses a library called JavaRosa. Either of these could contain Log4j, but they do not; instead, they use SLF4J: validate/build.gradle at 79204416473845e3…

[dadjoamc]

Thanks you @Kal_Lam