We at Squadcast firmly believe that the security of our platform and the data of our customers is of utmost importance. And we are transparent about any incident, especially if it threatens our security. To that end, we wanted to provide an update on the recently discovered zero-day vulnerability in the Java logging library - Log4j.

What happened?

On December 9, 2021, Apache publicly disclosed a remote code execution (RCE) vulnerability (CVE-2021-44228) in its popular Java logging library, Log4j. Since we do not use Log4j, Squadcast is not directly affected by the vulnerability. However, we’re auditing our integrations with critical vendors to ensure that there is no indirect impact.

Our Findings

Our own infrastructure is not vulnerable and hence, our platform is not impacted by this vulnerability. You can continue to use Squadcast and need not take any action for this vulnerability. One of our cloud-based vendors - Elasticsearch was vulnerable, but they've patched it as well.

Additionally, Squadcast is not a Java shop, so we do not use either of our notification providers' - Twilio's or Plivo's Java libraries. Even if either of them are affected by the vulnerability, it does not impact us as a Twilio/Plivo client.

Next steps

We’re continuously following up with our critical vendors to ensure that they’re applying the appropriate patches to their systems if they’re impacted by the vulnerability. As of today, we do not see any impact with our critical vendors as well. We are continuing to monitor this issue and will determine whether additional actions are required and update this blog accordingly.

For more information about our vendors, visit this page which has all the details about the Sub-processors of Squadcast.

In the below table you can find the list of our vendors and their vulnerability status as of 17th Dec 2021. This table will be further updated on a regular basis.