log4j - jamf pro server still on 10.34

[mickl089]

hello,
when we get the 10.34.1 patch? our managed jamf pro server is still on 10.34 😞

thanks!

[spotmac]

I suspect Jamf Pro is still vulnerable. Version 2.15.0 was used in the 10.31.1 update. 

[spotmac]

https://thehackernews.com/2021/12/second-log4j-vulnerability-cve-2021.html

[mm2270 · Accepted solution]

So, if you read Jamf's official statement on their cloud instances and this vulnerability, they specifically mention the issue has been addressed through other controls. Apparently Jamf cloud servers do not allow the type of traffic that would be required to use this exploit, even if a vulnerable version of log4j2 is still installed on them. So 10.34.1 may only be necessary for on prem servers.

I would imagine eventually, like maybe in the next full release, Jamf will roll in an updated version of log4j 2, maybe 2.16, so it's fully patched.

[jwojda]

I did reach out to jamf support re: this same question.  would be nice to have the warm fuzzy feeling of the version bump on the cloud.  I'm sure we could request the update given the situation.