[TIKA-3669] CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.1
• Fix Version/s: 2.3.0
• Component/s: app, server
• External issue URL: https://logging.apache.org/log4j/2.x/security.html
• External issue ID: CVE-2021-44832
• Assignee: Unassigned
• Reporter: Josh Burchard
• Created: 02/Feb/22 18:48
• Updated: 07/Feb/22 16:35
• Resolved: 07/Feb/22 16:35

Description

Possible to get Apache Log4j2 bumped up to version 2.17.1 in Tika?  I didn't see it mentioned in the pre-release notes for Tika 2.3.0 so I thought I'd ask here. Since it seems like log4j2 changes have ceased being a moving target, it'd be excellent to just have the latest and greatest version.

Apache Log4j Security Vulnerabilities

Issue Links

• is duplicated by: TIKA-3638 Log4J vulnerability mitigation by upgrading to latest