[LOG4J2-3409] workaround for jackson-mapper-asl-1.9.13.jar security vulnerability @ flume-ng

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.17.1
• Fix Version/s: 2.18.0
• Component/s: Flume Appender

Environment

java 11

• Assignee: Unassigned
• Reporter: alexander kravchik
• Created: 20/Feb/22 12:20
• Updated: 24/Jun/22 04:35
• Resolved: 24/Jun/22 04:35

Description

Dear colleagues, 

we are using log4j2 with flume-ng appender. 

The below vulnerabilities are found in the dependent jackson-mapper-asl-1.9.13.jar :

cve-2019-10202

cve-2019-10172

etc...

Please advise if this will be fixed and planned ETA in case it is already fixed

Thanks , 

Sasha

Issue Links

• is related to: LOG4J2-3536 Upgrade Flume to 1.10.0