Is the IDE affected by the Log4j security vulnerability (December 2021, CVE-2021-44228, Log4Shell)

Is logi.CAD 3 (= the IDE) affected by this security vulnerability?

Yes, but only if you are using a version before V2.0.0 for logi.CAD 3 (= the IDE) that also contains the test framework. Observe: The test framework is not provided in all variants of logi.CAD 3

This is how you can check whether both conditions apply to your used logi.CAD 3 version/variant:

1. In logi.CAD 3, open the Help menu and select the command About logi.CAD 3. Check which version number is displayed in the dialog.

2. In logi.CAD 3, open a project with at least one POU that meets the requirements listed under "Preparing an existing project for tests". Check whether you are able to create a test suite for this POU. If yes, the logi.CAD 3 variant contains the test framework.

If you are using a logi.CAD 3 version 1.126.0 (or a previous version) and this version contains the test framework, this version/variant of logi.CAD 3 affected by the Log4j security vulnerability according to https://logging.apache.org/log4j/2.x/security.html. Reason: The test framework in these versions is based on Java and uses a vulnerable version of the Log4j component.

Recommended procedure: Install the current logi.CAD 3 version.
However, if you need or want to continue using a logi.CAD 3 version that is affected in principle, you can close the Log4j security vulnerability by deleting the class JndiLookup for the test framework and the workspace as follows:

1. In the explorer of the operating system explorer: Change to the installation folder of logi.CAD 3. Then change into the subfolder \plugins\com.logicals.lc3.testframework.core_x.y.z\bin\ (x.y.z .z corresponds to the version number of logi.CAD 3).

2. Locate the file com.logicals.lc3.testframework.robot.keywords.jar in this folder.

3. Open this file using "7-zip".
   Use a file archiver tool that processes nested packages correctly . Example: the free file archiver "7-zip" – download is possible under: http://7-zip.org/ If you use a different file archiver tool , proceed analogously to the next steps.

4. In the file, change to: org\apache\logging\log4j\core\lookup\

5. Delete the file JndiLookup.class.
   Result: The potential weak spot for attacks is now removed. You are still able to use the test framework without any restrictions.
   

6. If you want to use an existing workspace for the logi.CAD 3version, you must also delete the file JndiLookup.class from the jar file that exists for the workspace.
   The relevant jar file can be found under the subfolder .metadata\.plugins\com.logicals.lc3.testframework.core\ of the workspace.