Page History

Metabase includes Log4j and is vulnerable to CVE-2021-44228. For a first fix we update to Metabase 0.40.7 (which includes Log4j 2.15.0 and protects from the remote code execution exploit).

The more recently discovered CVE-2021-45046 requires Log4j 2.16.0 for which no Metabase release is available yet. 
However: this newer CVE is far less critical, and according to Metabase developers it should not even be affected by it. Still, we are waiting for a new Metabase version and will create new releases once it is available just to be as safe as possible. In the meantime, if

If you are unsureuncomfortable with CVE-2021-45046, you can update to the fix version for the original CVE and manually turn off Metabase in the affected productsfor now:

• Connect to the appliance with ssh or putty

• For GreenLight:

  Code Block
  docker stop gl_metabase

• For OfficeExpert and iDNA Applications:

  Code Block
  docker stop panagenda_metabase