• Type: Bug
• Resolution: Fixed
• Priority: Critical
• Component/s: talend-plugin
• Labels:

  • CVE-2021-44228
  • jcabot:001
  • jcabot:002
  • security

[JENKINS-67360] log4j dependency has critical vulnerability CVE-2021-44228 in Talend Plugin

Daniel Beck created issue - 2021-12-11 09:32

Collapse comment: P Peters added a comment - 2021-12-11 20:29

P Peters added a comment - 2021-12-11 20:29

The 1.3 version, just released has upgraded the dependency to log4j-core 2.15

Expand comment: P Peters added a comment - 2021-12-11 20:29

P Peters added a comment - 2021-12-11 20:29 The 1.3 version, just released has upgraded the dependency to log4j-core 2.15

Collapse comment: P Peters added a comment - 2021-12-11 20:35

P Peters added a comment - 2021-12-11 20:35

Quickly updated the dependency in the tmc_rest_api to log4j-core 2.15. Didnt bump the version of that library.

here is the commit https://github.com/TalendStuff/tmc_rest_api/commit/8c6e8c260f4c3148f943ecee7320008848ebc73a

 

The release is uploaded and available.

Expand comment: P Peters added a comment - 2021-12-11 20:35

P Peters added a comment - 2021-12-11 20:35 Quickly updated the dependency in the tmc_rest_api to log4j-core 2.15. Didnt bump the version of that library. here is the commit https://github.com/TalendStuff/tmc_rest_api/commit/8c6e8c260f4c3148f943ecee7320008848ebc73a   The release is uploaded and available.

P Peters made changes - 2021-12-11 20:35

Released As		New: Manual release 1.3
Resolution		New: Fixed [ 1 ]
Status	Original: Open [ 1 ]	New: Resolved [ 5 ]

Daniel Beck made changes - 2021-12-11 21:51

Priority

Original: Minor [ 4 ]

New: Critical [ 2 ]

Collapse comment: Daniel Beck added a comment - 2021-12-11 21:54

Daniel Beck added a comment - 2021-12-11 21:54

I confirm the plugin now includes log4j 2.15.0.

Good job, you're the first maintainer to react

Expand comment: Daniel Beck added a comment - 2021-12-11 21:54

Daniel Beck added a comment - 2021-12-11 21:54 I confirm the plugin now includes log4j 2.15.0. Good job, you're the first maintainer to react

Daniel Beck made changes - 2021-12-11 21:54

Status

Original: Resolved [ 5 ]

New: Closed [ 6 ]

Jenkins CERT Bot made changes - 2022-01-30 14:31

Labels

Original: CVE-2021-44228 security

New: CVE-2021-44228 jcabot:001 jcabot:002 security