[MRM-2023] Critical Log4j RCE bug (CVE-2021-44228)

• Type: Dependency upgrade
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.2.5
• Fix Version/s: 2.2.6
• Component/s: Audit Logging
• Assignee: Martin Schreier
• Reporter: Robert Velter
• Created: 12/Dec/21 17:24
• Updated: 15/Dec/21 21:05
• Resolved: 15/Dec/21 21:05

Description

The log4j version in archiva 2.2.5 is 2.8.2. This version is affected by CVE-2021-44228 (RCE).

Upgrading dependency to log4j version 2.15.0 (if easy possible) would solve this issue.

Best regards, Robert