[WW-5151] Bump to 2.15.0 to fix log4j vulnerability

• Type: Dependency
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.5.20, 2.5.22, 2.5.25, 2.5.26, 2.5.27
• Fix Version/s: 6.0.0
• Component/s: Core Actions, Other

Environment

Any version that uses log4j before 2.15.0

• Flags: Patch, Important
• External issue URL: https://github.com/apache/struts/pull/511

Language

Java

• Assignee: Unassigned
• Reporter: Paulino Calderon
• Created: 10/Dec/21 07:08
• Updated: 14/Jun/22 09:47
• Resolved: 12/Dec/21 12:13

Description

Hello,

It seems Apache struts is affected by the log4j vulnerability. I've shared my findings with the security team privately where you could review the vulnerable code paths.

 

Github PR: https://github.com/apache/struts/pull/511

Issue Links

• links to: GitHub Pull Request #511