is BBMap/Qualimap affected by log4j vulnerability

Question

[tamu.anand]

Hi all

Does anyone know if BBTools/BBMap and Qualimap are affected by the log4j vulnerability announced on 09-Dec-2021

Probably GenoMax and/or Brian Bushnell might be able to answer for BBMap

https://github.com/nf-core/rnaseq/issues/734#issuecomment-995031975

Thanks in advance

Answer 1

[Pierre Lindenbaum]

no, unless the tools are used as a library in a web server.

Answer 2

[colindaven]

It's worth noting picard.jar and abra.jar are affected (even though as Pierre L says, these are unlikely to be attacked on most systems).

If you're responsible for systems, esp web servers, it would pay to upgrade by downloading the latest jar and removing the older ones.

Not sure how bad a problem this could be with Galaxy webservers for example, where picard is used widely.