[KAFKA-13594] In TNPM Wireline Project, vulnerability found in Log4j-1.2.17.jar under KAFKA directory

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.0
• Component/s: log, logging
• Flags: Important

Language

English

• Assignee: Unassigned
• Reporter: Waseem
• Created: 13/Jan/22 09:54
• Updated: 15/Jan/22 00:02

Description

In TNPM wireline project, we used kafka2.6.x which is using Log4j-1.2.17.jar in which we found this JMSAppender.class.

Is this class is vulnerable for Log4j-1.2.17.jar ?

Could you please suggest any steps or refer to any document ?