[ZOOKEEPER-4452] Log4j 1.X CVE-2022-23302/5/7 vulnerabilities

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.8.0, 3.7.1, 3.6.4
• Component/s: security
• Assignee: Enrico Olivelli
• Reporter: Dominique Mongelli
• Created: 25/Jan/22 14:24
• Updated: 09/Oct/23 11:20
• Resolved: 29/Mar/22 07:42

Description

Some log4j 1.x vulnerabilities have been disclosed recently:   

• CVE-2022-23302: https://nvd.nist.gov/vuln/detail/CVE-2022-23302    
• CVE-2022-23305 : https://nvd.nist.gov/vuln/detail/CVE-2022-23305    
• CVE-2022-23307 : https://nvd.nist.gov/vuln/detail/CVE-2022-23307

We would like to know if zookeeper is affected by these vulnerabilities ?

Issue Links

• is related to: ZOOKEEPER-4427 Migrate to Logback
• relates to: ZOOKEEPER-4455 Move to https://reload4j.qos.ch/ (remove log4j1)