We are aware of the issue with the badge emails resending to everyone, we apologise for the inconvenience - learn more here.
Forum Discussion
Log4j Breach
After the discovery of the security breach caused by Log4j on the weekend of December 10-12, 2021. We need to know if your software is vulnerable to this security breach.
Hey Bigjoe910 & leksikon - thanks for your patience while we conducted a thorough review of services and components across all Dropbox products.
We have hardened all instances of log4j that were identified on HelloSign and Dropbox-owned platforms by applying a patch or taking other appropriate action. Like many other service providers, we continue to work with our vendors to assess impact and remediation efforts. Our systems are functioning normally and we are not aware of any active threat.
I hope this information helps!
My company is also asking for a status on this - is Dropbox and HelloSign affected?
- Walter
Dropbox Staff
Hey Bigjoe910 & leksikon - thanks for your patience while we conducted a thorough review of services and components across all Dropbox products.
We have hardened all instances of log4j that were identified on HelloSign and Dropbox-owned platforms by applying a patch or taking other appropriate action. Like many other service providers, we continue to work with our vendors to assess impact and remediation efforts. Our systems are functioning normally and we are not aware of any active threat.
I hope this information helps!
Is there any update on if both CVE's related to Log4j are remediated or mitigated on the Dropbox platform? The latest CVE was just added late 12/14/2021.
CVE-2021-45046
CVE-2021-44228Is there any update on if both CVE's related to Log4j are remediated or mitigated on the Dropbox platform? The latest CVE was just added late 12/14/2021.
CVE-2021-45046
CVE-2021-44228Hello everyone
I wrote Dropbox support and received a generic response that they are looking into it and will work the various vendors to work with to provide a safe environment (basically that is what it said); This is disappointing that we need to push the vendor to provide an update to us. TO date (12/21/21) I have not seen a dedicated page on their website for Log4J.
Zee
Hi,
Do you have any update? Could you please confirm how does this affect Dropbox and/or if it has already been mitigated?
Thank you and I look forward to your response.
Kind Regards,
JCarreon
- WalterHi all - thanks for your nudges.
I just wanted to re-iterate that since the incident was originally reported, we have hardened all instances of log4j that were identified on HelloSign and Dropbox-owned platforms by applying a patch and/or taking other appropriate actions.
Just like other service providers, we continue to work with our vendors to assess impact and remediation efforts.
Our systems are functioning normally at the moment and we are not aware of any active threat.
I hope this helps!
