[ZOOKEEPER-3817] owasp failing due to CVE-2020-9488

• Type: Task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.7.0, 3.5.8, 3.6.2
• Component/s: security
• Assignee: Mate Szalay-Beko
• Reporter: Patrick D. Hunt
• Created: 04/May/20 04:53
• Updated: 11/May/20 15:41
• Resolved: 04/May/20 12:14

Description

OWASP job is failing due to

[ERROR] log4j-1.2.17.jar: CVE-2020-9488

From the CVE summary it doesn't seem to affect us (SMTPS related which we don't use) but we should address, probably by whitelisting the CVE?

Issue Links

• is related to: ZOOKEEPER-2342 Migrate to Log4J 2.