At the moment, based on a quick search of bundled jars in their latest releases, the following plugins seem to be affected:

• https://plugins.jenkins.io/audit-log 1.2 (JENKINS-67355)
• https://plugins.jenkins.io/bootstraped-multi-test-results-report 2.1.3
• https://plugins.jenkins.io/checkmarx 2021.4.2 (JENKINS-67356)
• https://plugins.jenkins.io/hp-application-automation-tools-plugin 7.1 (JENKINS-67357)
• https://plugins.jenkins.io/lambdatest-automation 1.19.4 (JENKINS-67358)
• https://plugins.jenkins.io/peass-ci 2.0.0-531.vbd2ffb53e017 (#71)
• https://plugins.jenkins.io/pipeline-huaweicloud-plugin 0.0.1 (JENKINS-67359)
• https://plugins.jenkins.io/reliza-integration 0.1.13 (#1)
• https://plugins.jenkins.io/talend 1.2-rc40.961f08b398b6 (JENKINS-67360)
• https://plugins.jenkins.io/testdroid-run-in-cloud 2.116.0 (JENKINS-67361)
• https://plugins.jenkins.io/thundra-foresight 11.vbc9483778bb3 (#3)
• https://plugins.jenkins.io/venafi-vcert 2.0.0 (#9)
• https://plugins.jenkins.io/xray-connector 2.5.1 (#53)

I've made a PR to bootstraped-multi-test-results-report - https://github.com/web-innovate/bootstraped-multi-test-results-report/pull/100
It hasn't been released in 3 years, so I'm not sure how soon we can get a patch release out for it.
It's a transitive dependency of the github-plugin which appears to be popular.
In my case it was the only plugin that used log4j >= 2.0 and < 1.15.
I was able to create a local build and deploy the patched version from https://github.com/rahulsom/bootstraped-multi-test-results-report/tree/v2.1.4-nflx.2
It includes that PR and a few more I've opened against that project.

rahulsom I suspect you will need to adopt the plugin. Thanks for the pull requests. If you're interested in other ideas to modernize the plugin, refer to "Contributing to Open Source", the workshop from DevOps World 2021.

Applying the patch

$ git diff
diff --git a/src/main/java/org/jenkinsci/deprecatedusage/DeprecatedUsage.java b/src/main/java/org/jenkinsci/deprecatedusage/DeprecatedUsage.java
index f19b40e..ca0c103 100644
--- a/src/main/java/org/jenkinsci/deprecatedusage/DeprecatedUsage.java
+++ b/src/main/java/org/jenkinsci/deprecatedusage/DeprecatedUsage.java
@@ -164,6 +164,9 @@ public class DeprecatedUsage {
      * @see Options
      */
     private boolean shouldAnalyze(String className)  {
+        if (className.endsWith("JndiLookup")) {
+            System.err.println("Found " + className + " in " + this.plugin.artifactId);
+        }
 
         if (className.endsWith("DefaultTypeTransformation")) {
             // various DefaultTypeTransformation#box signatures seem false positive in plugins written in Groovy

to https://github.com/jenkins-infra/usage-in-plugins to identify shaded dependencies.

I did not find any results not already identified previously:

Found org/apache/logging/log4j/core/lookup/JndiLookup in audit-log
Found org/apache/logging/log4j/core/lookup/JndiLookup in bootstraped-multi-test-results-report
Found org/apache/logging/log4j/core/lookup/JndiLookup in checkmarx
Found org/apache/logging/log4j/core/lookup/JndiLookup in hp-application-automation-tools-plugin
Found org/apache/logging/log4j/core/lookup/JndiLookup in lambdatest-automation
Found org/apache/logging/log4j/core/lookup/JndiLookup in peass-ci
Found org/apache/logging/log4j/core/lookup/JndiLookup in pipeline-huaweicloud-plugin
Found org/apache/logging/log4j/core/lookup/JndiLookup in reliza-integration
Found org/apache/logging/log4j/core/lookup/JndiLookup in talend
Found org/apache/logging/log4j/core/lookup/JndiLookup in testdroid-run-in-cloud
Found org/apache/logging/log4j/core/lookup/JndiLookup in thundra-foresight
Found org/apache/logging/log4j/core/lookup/JndiLookup in venafi-vcert
Found org/apache/logging/log4j/core/lookup/JndiLookup in xray-connector

https://plugins.jenkins.io/cucumber-reports/ included log4j 2.x from 1.1.0 to 3.16.0 (both inclusive). While long obsolete (3.17.0 released spring 2018), might still apply to some instances.

https://github.com/web-innovate/bootstraped-multi-test-results-report is the repo for that plugin. Update to log4j 2.15.0 has been merged but not released. PR is open for updating to 2.16.0.

Description updated with the new vulnerability (not critical)

SLF4J Comments on the CVE-2021-44228 vulnerability - http://slf4j.org/log4shell.html

The list in the issue description should now be complete (unless some plugins apply some very unusual repackaging to their dependencies).

Besides the top-level search for presence of log4j-core-xx.jar, I also looked for any (possibly shaded) JndiLookup.class in any other included jars, and only found thundra-agent-maven-test-instrumentation-0.0.6.jar which is part of thundra-foresight 11.vbc9483778bb3, which we've already identified through its bundled log4j-core-xx.jar.

Latest from Apache suggests there exists a possible edge case DOS via infinite recursion - CVE-2021-45105 and the fix in delivered in log4-2.17.0

ianw You're correct. Due to the more configuration requirements for the second and third vulnerabilities, I regret to have added 2.16 tracking here. I would bet that only 2.15 matters for our plugins.

wfollonier, it's just like Covid; you need the vaccine, first and second dose, plus a booster. Let's hope that the end of it after this!

https://github.com/web-innovate/bootstraped-multi-test-results-report
I'm stuck with releasing it, as I can't access the account I was using to publish new versions
I've submitted a permission change in: https://github.com/jenkins-infra/repository-permissions-updater/pull/2269

once this one lands in, and I can push something, 2.2.x will be released and will include the fixes for the log4j, along with some more stuff

for https://github.com/web-innovate/bootstraped-multi-test-results-report 2.2.1 version has been released, it will become available shortly

thanks

bogdanlivadariu bobo_4r3al Thanks for the release, table updated

Just found that the plugin, analysis-model-api, uses the log4j library

https://github.com/jenkinsci/analysis-model-api-plugin

Thanks!

daveaugustus the use of log4j does not make the plugin vulnerable. Unless you have specific details that show that a vulnerable version of log4j is included in the plugin, then its use of log4j is not an issue. The most recent release of analysis model api plugin includes log4j 2.19.0 in its packaging. The log4j 2.19.0 release is not vulnerable.