Log4j vulnerability and Xamarin.Forms

Question

Does this security vulnerability https://security.stackexchange.com/questions/257873/does-cve-2021-44228-impact-log4j-ports have any impact on Xamarin.Forms app?

Answer 1

Not directly.

Xamarin itself doesn't include log4j, Xamarin apps are unlikely to use log4j, and the vulnerability targets servers not mobile apps.

The point of Xamarin is to write a mobile app in .Net rather than in Java, so Xamarin apps are much more likely to use Log4net rather than Log4j. Per the linked StackExchange thread, Log4net doesn't have the vulnerable code that is in Log4j

Additionally, CVE-2021-44228 requires using Log4j in conjunction with server features that are not exposed to mobile apps.