Apache Log4j vulnerability

In recent days we have received many tickets asking about the Apache Log4j vulnerability that has been all over the media. It is an extremely critical vulnerability that has been named Log4Shell.

In our services, Apache Log4j is used only in Dovecot Sorl. This system provides fast, efficient results when you run any kind of large search across your email (IMAP only), for example searching for a text string in all your email from the webmail search box.

The security patch was applied the same day the vulnerability came to light, followed by further updates in the days after.

As the Dovecot Sorl service is not exposed to the public, the risk is limited (all systems have been audited and the vulnerability was not exploited in any case). Exploiting it would first have required the attacker to have valid login details for an email account on our infrastructure, and then to know that this library is used in searches.

Even with all the patches applied, and given the access limitations, we have decided to disable Dovecot Sorl temporarily as an extra precaution until security experts confirm that the patches are 100% effective. As it is not a critical service, the only downside is that email searches will be slower over the coming weeks, by which time we will be confident we can re-enable the system without risk.