You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@groovy.apache.org by "Paul King (Jira)" <ji...@apache.org> on 2021/12/29 03:05:00 UTC

[jira] [Created] (GROOVY-10435) Bump log4j2 version to 2.17.1 (test dependency)

Paul King created GROOVY-10435:
----------------------------------

             Summary: Bump log4j2 version to 2.17.1 (test dependency)
                 Key: GROOVY-10435
                 URL: https://issues.apache.org/jira/browse/GROOVY-10435
             Project: Groovy
          Issue Type: Dependency upgrade
            Reporter: Paul King
            Assignee: Paul King


Groovy doesn't bundle a version of Log4j in its distribution nor list it as a dependency in its pom (or bom), so isn't directly affected by CVE-2021-44832 (see https://logging.apache.org/log4j/2.x/security.html).

However Groovy users using the Log4j2 AST transform (or using Log4j2 directly) may wish to update there version of Log4j or note the security workarounds mentioned in the above security vulnerability link.

See also:
* LOG4J2-3293: JDBC Appender should use JNDI Manager and JNDI access should be limited
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832



--
This message was sent by Atlassian Jira
(v8.20.1#820001)