[IGNITE-13464] Ignite-rest-http modules includes vulnerable dependencies

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.9, 2.8.1
• Fix Version/s: 2.12
• Component/s: rest
• Assignee: Sergei Ryzhov
• Reporter: Stephen Darlington
• Created: 21/Sep/20 10:18
• Updated: 28/Dec/21 15:38
• Resolved: 28/Dec/21 15:38

Description

The ignite-rest-http module includes a vulnerable version of the log4j library. It also appears to include slf4j. Why does the REST API include its own logging libraries?

This was spotted in 2.8.1 but still appears to be an issue in master and 2.9.

More here:

http://apache-ignite-users.70518.x6.nabble.com/critical-security-vulnerability-for-opt-ignite-apache-ignite-libs-optional-ignite-rest-http-log4j-1-r-td34031.html

Issue Links

• is cloned by: IGNITE-13601 Ignite-rest-http and ignite-kubernetes include vulnerable dependencies
• links to: GitHub Pull Request #9676