[LOG4J2-3245] log4j-core-2.0-beta9.jar CVE-2021-44228 vulnerability

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0-beta9
• Fix Version/s: 2.16.0
• Component/s: Core
• Flags: Patch, Important
• Assignee: Unassigned
• Reporter: Chaitanya
• Created: 16/Dec/21 17:20
• Updated: 16/Dec/21 20:42
• Resolved: 16/Dec/21 20:42

Description

log4j-core-2.0-beta9.jar CVE-2021-44228 vulnerability is not resolved by removing org/apache/logging/log4j/core/lookup/JndiLookup.class as this version of ** depends on JndiLookup. Request to suggest how to remediate this.{}{}

Issue Links

• duplicates: LOG4J2-3221 JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0