[KAFKA-13616] Log4j 1.X CVE-2022-23302/5/7 vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Assignee: Unassigned
• Reporter: Dominique Mongelli
• Created: 25/Jan/22 14:23
• Updated: 09/Feb/22 11:07
• Resolved: 09/Feb/22 11:07

Description

Some log4j 1.x vulnerabilities have been disclosed recently:   

• CVE-2022-23302: https://nvd.nist.gov/vuln/detail/CVE-2022-23302    
• CVE-2022-23305 : https://nvd.nist.gov/vuln/detail/CVE-2022-23305    
• CVE-2022-23307 : https://nvd.nist.gov/vuln/detail/CVE-2022-23307

We would like to know if kafka is affected by these vulnerabilities ?

 

Issue Links

• duplicates: KAFKA-9366 Upgrade log4j to log4j2