Is my system vulnerable to Log4Shell vulnerability?

Solution 1:

If you don't run any software that's using Java you're fine (at least for this exploit).

Do however keep in mind that there's a lot of things that use Java under the hood while having a native compiled application to start things and have an embedded JVM. Those are potentially affected. Examples of this are for example Jetbrains CLion and PyCharm, both are Java applications.

Of course the only such applications that are vulnerable to actual attack are those that can be accessed from the internet (or by an active intruder on your network, in which case you have a far bigger problem.

The aforementioned Jetbrains products aren't among those btw, they are just examples of things that run Java under water when the end user may not even be aware of it. Nor do they rely on Log4J2, they use another logging solution internally.

Were you running say Jira or Confluence, or other products like that, you might be vulnerable and should check with your suppliers.