Log4J Vulnerabilities

[joshmurari]

Hey everyone,

Based on the recent public reports of vulnerabilities regarding Log4j, is this something that impacts the windows, ubuntu, or mac OS images that are built here?

[miketimofeev]

Hi @joshmurari!
We do not install log4j explicitly and have also inspected build logs and see no trace of log4j in any dependencies.

[joshmurari]

Thanks for the response!

[mthoger]

@miketimofeev Maven has log4j files, in the apaches logging paths.
isn't that a part of the hole deal ?

[miketimofeev]

@mthoger it's just a cache that doesn't seem to be used anywhere. I have prepared the PR to clean up this directory just in case #4761

[mthoger]

Thanks for the response!

[spyder007]

@miketimofeev, for your information, a newly provisioned machine (as of 12/18) has log4j in that same cache, but the version is now 2.16 (a build from Sept 29 had 2.11).

It would seem that potentially Maven/Apache has updated their packages as of last week.