You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "vijay (Jira)" <ji...@apache.org> on 2021/12/11 18:13:00 UTC

[jira] [Commented] (KAFKA-13535) Workaround for mitigating CVE-2021-44228 Kafka

    [ https://issues.apache.org/jira/browse/KAFKA-13535?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17457701#comment-17457701 ] 

vijay commented on KAFKA-13535:
-------------------------------

Hi Luke 

I am using kafka 2.0 and and log4j is 1.2.17 .  and i dont see log4j-core* jar .  

 ./kafka-topics.sh --version
2.0.0  

./libs/log4j-1.2.17.jar

is this version got affected by this . 

> Workaround for mitigating CVE-2021-44228 Kafka 
> -----------------------------------------------
>
>                 Key: KAFKA-13535
>                 URL: https://issues.apache.org/jira/browse/KAFKA-13535
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 2.8.1
>            Reporter: Akansh Shandilya
>            Priority: Major
>
> Kafka v2.8.1 uses log4j v1.x . Please review following information :
>  
> Is Kafka v2.8.1 impacted by  CVE-2021-44228?
> If yes, is there any workaround/recommendation available for Kafka  v2.8.1 to mitigate CVE-2021-44228



--
This message was sent by Atlassian Jira
(v8.20.1#820001)