[HOP-3566] CVE-2021-4104 and CVE-2019-17571 on log4j version 1.2.17

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.1.0
• Component/s: Build, Hop GUI, Technology
• Labels: pull-request-available
• Assignee: Hans Van Akelyen
• Reporter: Igors
• Created: 18/Dec/21 09:39
• Updated: 20/Dec/21 14:20
• Resolved: 20/Dec/21 14:20

Description

Apache Log4j 1.2.17 has two vulnerabilities 

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

 

Should be upgraded to latest Apache Log4j Core (>2.17.x)

Apache Log4j 1.2 reached end of life in August 2015

 

Issue Links

• links to: GitHub Pull Request #1232