-
Task
-
Resolution: Won't Do
-
Major
-
None
-
None
-
None
-
None
-
False
-
False
-
ProdSec decided that we do not need to patch the log4j 1 CVE.
-
Log4j 1.2.17 needs to be rebuilt without JMSAppender (CVE-2021-4104), SocketServer (CVE-2019-17571) and SMTPAppender (CVE-2020-9488). Details on this GH thread.
The original 1.2.17 build is so old that is it not on PNC. It was originally done in BREW.
A new build will need to be set up in PNC. The orginal source code can be found at: https://logging.apache.org/log4j/1.2/source-repository.html
- blocks
-
ENTMQST-3564 Rebuild Kafka 2.8.0 with fixed Log4j1
- Closed
-
ENTMQST-3565 Rebuild Kafka 2.7.0 with fixed Log4j1
- Closed
-
ENTMQST-3567 Rebuild Cruise Control 2.5.11 with Log4j 1.2.17
- Closed
-
ENTMQST-3570 Rebuild Kafka 2.5.0 with fixed Log4j1
- Closed
-
ENTMQST-3571 Rebuild Kafka 2.6.2 with fixed Log4j1
- Closed