[DIRSERVER-2362] ApacheDS 2.0.0-M17 references older log4j that has security vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-M17
• Fix Version/s: 2.0.0.AM27
• Assignee: Unassigned
• Reporter: Michael
• Created: 10/Jan/22 15:21
• Updated: 25/Aug/22 14:01
• Resolved: 20/Aug/22 17:15

Description

ApacheDS 2.0.0-M17 (apacheds-service-2.0.0-M17.jar) references older log4j version that might have security vulnerabilities.  

Does ApacheDS 2.0.0-M17 log4j reference have security vulnerabilities?

Is there a newer ApacheDS version that uses newer log4j2 that resolves the security vulnerabilities?