[jira] [Created] (MNG-7441) Update Version of Logback to Address CVE-2021-42550

["Mac Hale (Jira)" <ji...@apache.org>]

Mac Hale created MNG-7441:
-----------------------------

             Summary: Update Version of Logback to Address CVE-2021-42550
                 Key: MNG-7441
                 URL: https://issues.apache.org/jira/browse/MNG-7441
             Project: Maven
          Issue Type: Bug
          Components: Dependencies
    Affects Versions: 3.8.5
            Reporter: Mac Hale


[CVE-2021-42550|https://nvd.nist.gov/vuln/detail/CVE-2021-42550] is present in Logback versions 1.2.7 and earlier. Maven uses v 1.2.1. Please update to Logback 1.2.9, which includes a fix as per [https://jira.qos.ch/browse/LOGBACK-1591|[https://jira.qos.ch/browse/LOGBACK-1591].]

I see ch.qos.logback 1.2.1 in {{./pom.xml}} and ch.qos.logback without a version specified in {{./maven-embedder/pom.xml}}

But I'm no expert on this code base so it's possible there are other versioned references.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)