[DOXIATOOLS-67] log4j 1.2 is unsupported - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Dependency upgrade
Status: Closed
Priority: Critical
Resolution: Fixed
Affects Version/s: doxia-linkcheck-1.2
Fix Version/s: doxia-linkcheck-1.3
Component/s: Doxia Linkcheck
Labels:
None

Description

It also has known security issues. Do we really need this in our classpath?

A security vulnerability, CVE-2019-17571 has been identified against Log4j 1. Log4j includes a SocketServer that accepts serialized log events and deserializes them without verifying whether the objects are allowed or not. This can provide an attack vector that can be expoited. Since Log4j 1 is no longer maintained this issue will not be fixed. Users are urged to upgrade to Log4j 2.