[jira] [Resolved] (ZOOKEEPER-4431) Log4j vulnerabilities in Apache zookeeper

["Chris Nauroth (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ZOOKEEPER-4431?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chris Nauroth resolved ZOOKEEPER-4431.
--------------------------------------
      Assignee: Chris Nauroth
    Resolution: Fixed

ZooKeeper is not impacted by the recent Log4J 2 CVEs, because it uses Log4J 1 instead of Log4J 2, so I'm going to close this issue.

The community is currently discussing next steps for Zookeeper's logging infrastructure in a few JIRA issues, pull requests and mail threads. I suggest watching those if you'd like to keep informed about progress.

https://issues.apache.org/jira/browse/ZOOKEEPER-2342
https://issues.apache.org/jira/browse/ZOOKEEPER-4427
https://github.com/apache/zookeeper/pull/1793
https://lists.apache.org/thread/1ktv03wvqtfg22d13c1yo1lgnjv6xpkt

> Log4j vulnerabilities in Apache zookeeper
> -----------------------------------------
>
>                 Key: ZOOKEEPER-4431
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-4431
>             Project: ZooKeeper
>          Issue Type: Bug
>    Affects Versions: 3.6.2
>         Environment: Prod
>            Reporter: lekshmi anandakrishnan
>            Assignee: Chris Nauroth
>            Priority: Critical
>
> Please confirm whether apache zookeeper 3.6.2 has any impact on the below log4j CVE`s. Apache zookeeper uses log4j 1.2.17 and since Log4J 1.X version is an end of life in Aug 2015 which is vulnerable already.
>  
> |CVE ID|Title|
> |CVE-2021-4104 (1.X)|Apache Log4j 1.2 Remote Code Execution Vulnerability|
> |CVE-2021-45105 (2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability (Log4Shell)|
> |CVE-2021-45046 (2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability (CVE-2021-45046)|
> |CVE-2021-44228(2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability (Log4Shell)|



--
This message was sent by Atlassian Jira
(v8.20.1#820001)