GHSA-j7c3-96rf-jrrp json
Critical vulnerability in log4j may affect generated PEAR projects
published 2021-12-16 4 y ago modified 2021-12-16 4 y ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Impact UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.
### Patches - The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version >= `2.0.1` for generating new PEAR projects.
- Existing maven PEAR projects can be patched by manually upgrading to `log4j` >= `2.16.0` in `pom.xml`.
### References https://www.lunasec.io/docs/blog/log4j-zero-day/
### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/averbis/pear-archetype/issues
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | de.averbis.textanalysis:pear-archetype | >=2.0.0, <2.0.1 |
2.0.1 |
References
Sources
- GitHub Advisory GHSA-j7c3-96rf-jrrp
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.