# Log4Shell does not affect Trino

DevFeed: [Log4Shell does not affect Trino](<https://devfeed.tech/articles/log4shell-does-not-affect-trino-8670.md>)

Original publisher: [Read original article](<https://trino.io/blog/2021/12/13/log4shell-does-not-affect-trino.html>)

Author: Brian Olsen

Published: 2021-12-13T00:00:00Z

Content type: news

Language: en

Sources: [Trino Blog](<https://devfeed.tech/sources/trino-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [elasticsearch](<https://devfeed.tech/tags/elasticsearch.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Trino reports that Log4Shell does not affect its core engine or runtime. It describes connector dependencies, planned dependency removal and a build rule banning direct log4j dependencies, and recommends upgrading custom plugins that use affected Log4j libraries.

## Source excerpt

In the last few days we had a surge of folks in our community reaching out with concerns over the Log4Shell exploit (CVE-2021-44228), and we want to inform you that Trino is not affected. Trino does not use log4j in the core engine or runtime classes. There are some connectors that include the log4j dependency from client dependencies, but are either not used or are not versions affected by the Log4Shell vulnerability. Regular security reviews, including code and dependency analysis, are part of the regular development process. As we learn more we will update the code to keep vulnerabilities out of the code.