Does Log4Shell ("CVE-2021-44228") affect K8S/Containers and/or function-as-a-service (FaaS) running image with affected log4j?

I would like to understand if this vulnerability affects ephemeral setups such as K8S/FaaS and how JNDI lookup can take place in such a setting.

1 Answer 1


The JNDI lookup is a capability of the Java program. This means it is independent from the environment the program runs it. The environment might though limit the communication needed to load the actual exploit code from the program. But as far as I know there is no general and default limit like this for programs running in a container environment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .