Is Apache Log4J is packaged with Microsoft SQL server Express 2019?

Question

Is Apache Log4J is packaged with Microsoft SQL server Express 2019?

Shruthi T 6

Please clarify if Log4J is packaged with Microsoft SQL server Express 2019.

1 answer

Your answer

Answer 1

YufeiShao-msft 7,146

Hi @Shruthi T ，

The answer is no, Here are editions and supported features of SQL Server 2019

In 2015, Apache announced Log4j 1.x has reached end-of-life. Microsoft recommends customers to upgrade to Log4j 2.16.0 for the latest security updates.

At the same time, because of the log4j exploit, The SQL Server does not have any known reliance on this vulnerable library.

For the most up to date information on the issue status, please refer to the MSRC Advisory and Microsoft Security Threat Intelligence sites.”

-------------

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Shruthi T 6 Reputation points

2021-12-15T06:19:07.357+00:00

Noticed that as per the thread, it is stated that SQL (Express) 2019 does install old log4j.
YufeiShao-msft 7,146 Reputation points

2021-12-15T07:07:27.737+00:00

As added in this thread, no Microsoft products ship Log4J, These are JDBC drivers only. Microsoft does not ship Java runtime, thus these jar files cannot be activated.
Shruthi T 6 Reputation points

2021-12-15T08:13:11.24+00:00

Please refer the reply from @StoreTDK , above.

>>>>>>

Try to look in the dir:

C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars

When I install the Express some log4J jar files are installed.

/Thomas

<<<<<<<<<
Tom Phillips 17,771 Reputation points

2021-12-15T13:12:49.303+00:00
This is the response further down in the thread:

Here is a comment I received from Microsoft about the DTS folder:
Engineering has confirmed that the log4j used in SSIS is not vulnerable. The vulnerability only affects log4j version 2.x

There are only 3 features/configurations of SQL that leverage Java directly and still under investigation.
 

Machine Learning (2019+)

Polybase

SQL Big Data Clusters

Share via

Is Apache Log4J is packaged with Microsoft SQL server Express 2019?

1 answer

Your answer