Loading...

XML

Word

Printable

Details

Type: Component Upgrade
Resolution: Done
Priority: Major
Fix Version/s: 18.0.2.Final, 19.0.0.Beta2, 19.0.0.Final
Affects Version/s: None
Component/s: Logging
Labels:
None

Git Pull Request:
https://github.com/wildfly/wildfly-core/pull/4912, https://github.com/wildfly/wildfly-core/pull/4913, https://github.com/wildfly/wildfly-core/pull/4922

Description

Further CVEs have been reported against log4j-core – CVE-2021-45105 and CVE-2021-44832. WildFly and WildFly Core don't ship log4j-core, only log4j-api but it's simpler just to move to Log4j releases that don't match the CPE for the CVEs than to explain the api vs core distinction.

This is already fixed in main via the dependabot PR https://github.com/wildfly/wildfly-core/pull/4913, but this JIRA can serve to flag it up in the release notes. For 18.x I'll send up a PR.

Attachments

Activity

People

Assignee:: Brian Stansberry

Reporter:: Brian Stansberry

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2022/01/10 3:24 AM

Updated:: 2023/12/10 2:45 AM

Resolved:: 2022/01/11 7:38 AM