DRV8434SEVM: Log4j

May

Part Number: DRV8434SEVM

Hi,

Customer want to know if the DRV8434SEVM is affected by Apache log4j version vulnerability, please see details below.

"We have been asked by our IT team to reach out to the vendors of the various software we use to see if they have been affected by the Apache log4j version 2 cybersecurity vulnerability. Please get back to me as soon as you can in reference to the DRV software so that I can designate to our IT group. "

I found in E2E that there is a official state for the CCS software in this link:
e2e.ti.com/.../ccstudio-log4j-vulnerability

Thank you in advance.

Regards,
Maynard

over 3 years ago

0 Ryan Kehr over 3 years ago

TI__Guru 55605 points

Maynard,

I really have no idea how to answer this.

I will assign to OSST to see if they know.

Regards,

Ryan

0 Pablo Armet over 3 years ago in reply to Ryan Kehr

TI__Mastermind 37683 points

Hi Maynard,

I have heard about the Log4J remote control access vulnerability that was recently found. It's a quite scary security vulnerability that can potentially allow a malicious individual from remotely controlling a machine so I understand your concern here. I don't think our EVMs can be vulnerable. However, I will reach out to our GUI developers and software engineer experts to verify if Log4J is used by our GUI or cloud-based GUI. Everyone is on vacation right now so I won't be able to get a reply from the team until next week. I will reach out to you with a reply as soon as I get a concrete answer.

Regards,

Pablo Armet

0 May over 3 years ago in reply to Pablo Armet

TI__Genius 9880 points

Hi Pablo,

Thank you for your response.

Looking forward for the good news.

Again, thank you in advance.

Regards,
Maynard

0 Pablo Armet over 3 years ago in reply to May

TI__Mastermind 37683 points

Maynard,

Will do

0 Murugavel4637 over 3 years ago

TI__Mastermind 41005 points

Maynard,

All our recent EVM GUI apps including the DRV8434SEVM GUI are implemented using TI GUI Composer Runtime, https://dev.ti.com/. TI GUI Composer Runtime is widely used across TI portfolio. GUI Composer User’s Guide link: https://dev.ti.com/gc/v2/help/GC_UserGuide_v2/index.html. Like Ryan mentioned it would be appropriate to either OSST or SDTO address this specific question for your customer.

Regards, Murugavel

0 May over 3 years ago in reply to Murugavel4637

TI__Genius 9880 points

Hi Murugavel ,

Thank you for the information, how can we address this specific concern? We do not have process on how we can reach out OSST or SDTO in our side. Will your side will be the one reaching them out?

Thank you in advance.

Regards,
Maynard

0 Pablo Armet over 3 years ago in reply to May

TI__Mastermind 37683 points

Hi Maynard,

I have already assigned it to the SDTO group

0 JohnS over 3 years ago in reply to Pablo Armet

TI__Guru**** 162065 points

The log4j that is in Code Composer Studio comes from Eclipse/CDT which is not part of GUI Composer. However, I will need to confirm with our developers that there is no log4j coming from any other source in the GUI Composer runtime.

John

0 May over 3 years ago in reply to JohnS

TI__Genius 9880 points

Hi John,

Thank you for the information, looking forward to your update.

Thank you in advance.

Regards,
Maynard

0 JohnS over 3 years ago in reply to May

TI__Guru**** 162065 points

Maynard,

I received confirmation this morning that we do not use log4j in GUI Composer.

Regards,

John

Motor drivers

Motor drivers forum

DRV8434SEVM: Log4j