You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jdo-dev@db.apache.org by "Michael Bouschen (Jira)" <ji...@apache.org> on 2021/12/15 20:09:00 UTC

[jira] [Reopened] (JDO-800) Update Log4j Version

     [ https://issues.apache.org/jira/browse/JDO-800?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Michael Bouschen reopened JDO-800:
----------------------------------

The fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations, see CVE-2021-45046 for details.

We should update log4j to 2.16.0.

> Update Log4j Version
> --------------------
>
>                 Key: JDO-800
>                 URL: https://issues.apache.org/jira/browse/JDO-800
>             Project: JDO
>          Issue Type: Improvement
>          Components: tck
>    Affects Versions: JDO 3.2
>            Reporter: Michael Bouschen
>            Assignee: Michael Bouschen
>            Priority: Major
>             Fix For: JDO 3.2
>
>
> Log4j Versions up to 2.14.1 have a security finding CVE-2021-44228.
> Update log4j to version 2.15.0



--
This message was sent by Atlassian Jira
(v8.20.1#820001)