Major news carriers have been reporting recently on log4j vulnerabilities in Java applications. Both the OME team in Dundee as well as Glencoe Software have evaluated the libraries used by OMERO.server and OMERO.insight. We can say with confidence that OMERO and OMERO Plus are not vulnerable, as they do not utilize log4j and no immediate action that needs to be taken.
The only remaining use of log4j in OME software is in the
loci_tools.jar which we will now be removing. The
provides the same functionality using the logback library
for logging. This has been published as
2021-SV4 log4j in loci_tools.jar.
— December 13, 2021