You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@zookeeper.apache.org by "Chris Nauroth (Jira)" <ji...@apache.org> on 2022/01/08 04:19:00 UTC

[jira] [Resolved] (ZOOKEEPER-4423) Upgrade Log4j to 2.15.0 - CVE-2021-44228

     [ https://issues.apache.org/jira/browse/ZOOKEEPER-4423?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chris Nauroth resolved ZOOKEEPER-4423.
--------------------------------------
    Resolution: Invalid

ZooKeeper is not impacted by this specific CVE, because it uses Log4J 1 instead of Log4J 2, so I'm going to close this issue.

The community is currently discussing next steps for Zookeeper's logging infrastructure in a few JIRA issues, pull requests and mail threads. I suggest watching those if you'd like to keep informed about progress.

https://issues.apache.org/jira/browse/ZOOKEEPER-2342
https://issues.apache.org/jira/browse/ZOOKEEPER-4427
https://github.com/apache/zookeeper/pull/1793
https://lists.apache.org/thread/1ktv03wvqtfg22d13c1yo1lgnjv6xpkt

> Upgrade Log4j to 2.15.0 - CVE-2021-44228
> ----------------------------------------
>
>                 Key: ZOOKEEPER-4423
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-4423
>             Project: ZooKeeper
>          Issue Type: Task
>    Affects Versions: 3.6.0, 3.6.3, 3.7.0, 3.6.1, 3.6.2, 3.6.4
>            Reporter: Sai Kiran Vudutala
>            Priority: Major
>
> Log4j has an RCE vulnerability, see [https://www.lunasec.io/docs/blog/log4j-zero-day/]
> References. 
> [https://github.com/advisories/GHSA-jfh8-c2jp-5v3q]
> [https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126]
>  



--
This message was sent by Atlassian Jira
(v8.20.1#820001)