You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by "benzman81 (via GitHub)" <gi...@apache.org> on 2026/01/14 11:24:33 UTC
[I] Fix CVE-2025-68161 [poi]
benzman81 opened a new issue, #995:
URL: https://github.com/apache/poi/issues/995
Hi,
in the current release log4j-api in version 2.24.3 is used which now raises a security issue in our systems: CVE-2025-68161 (https://nvd.nist.gov/vuln/detail/CVE-2025-68161).
I already noticed source code changes in poi to upgrade to log4j-api 2.25.3 which addresses this issue, but there is no release yet with this change.
Any chance we can expect a release soon, or is there a time frame when to expect the release?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [I] Fix CVE-2025-68161 [poi]
Posted by "centic9-dt (via GitHub)" <gi...@apache.org>.
centic9-dt commented on issue #995:
URL: https://github.com/apache/poi/issues/995#issuecomment-3750004197
We usually don't release for security fixes in transitive dependencies as there are many many such updates released constantly and only very few have actual security-impact on how Apache POI uses them.
Until the next version of Apache POI is available, you can easily add the newer version of log4j as explicit dependency in Gradle or Maven which will include the fixed version for you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [I] Fix CVE-2025-68161 [poi]
Posted by "benzman81 (via GitHub)" <gi...@apache.org>.
benzman81 commented on issue #995:
URL: https://github.com/apache/poi/issues/995#issuecomment-3754291539
thank you
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [I] Fix CVE-2025-68161 [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on issue #995:
URL: https://github.com/apache/poi/issues/995#issuecomment-3751178465
The CVE is not even in log4j-api. It is in log4j-core. And you don't need log4j-core to run poi.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [I] Fix CVE-2025-68161 [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning closed issue #995: Fix CVE-2025-68161
URL: https://github.com/apache/poi/issues/995
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [I] Fix CVE-2025-68161 [poi]
Posted by "centic9 (via GitHub)" <gi...@apache.org>.
centic9 commented on issue #995:
URL: https://github.com/apache/poi/issues/995#issuecomment-3750009196
We usually don't release for security fixes in transitive dependencies as there are many many such updates released constantly and only very few have actual security-impact on how Apache POI uses them.
Until the next version of Apache POI is available, you can easily add the newer version of log4j as explicit dependency in Gradle or Maven which will include the fixed version for you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org