[DOXIATOOLS-67] log4j 1.2 is unsupported

• Type: Dependency upgrade
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: doxia-linkcheck-1.2
• Fix Version/s: doxia-linkcheck-1.3
• Component/s: Doxia Linkcheck
• Assignee: Elliotte Rusty Harold
• Reporter: Elliotte Rusty Harold
• Created: 20/Sep/20 11:59
• Updated: 03/Jun/21 09:21
• Resolved: 03/Jun/21 09:21

Description

It also has known security issues. Do we really need this in our classpath?

A security vulnerability, CVE-2019-17571 has been identified against Log4j 1. Log4j includes a SocketServer that accepts serialized log events and deserializes them without verifying whether the objects are allowed or not. This can provide an attack vector that can be expoited. Since Log4j 1 is no longer maintained this issue will not be fixed. Users are urged to upgrade to Log4j 2.

Issue Links

• links to: GitHub Pull Request #2