Uploaded image for project: 'ONgDB'
  1. ONgDB
  2. ONGDB-280

Remove log4j 1.2.17 to fix critical vulnerability

    XMLWordPrintable

Details

    • Story
    • Status: Done
    • Highest
    • Resolution: Done
    • 1.0.0
    • 1.0.1
    • None
    • None

    Description

      Resolves the following issue reports:

      1. https://github.com/graphfoundation/ongdb/security/dependabot/28
      2. https://github.com/graphfoundation/ongdb/security/dependabot/27
      3. https://github.com/graphfoundation/ongdb/security/dependabot/26

      Requires removal of log4j or replacing log4j with reload4j.

      The log4j dependency is only a test dependency and therefore the vulnerability has a lower impact.

      The log4j dependency comes in two places:

      [INFO] org.graphfoundation.ongdb:ongdb-security-enterprise:jar:1.0.1-SNAPSHOT
      [INFO] \- org.apache.directory.server:apacheds-server-integ:jar:2.0.0-M21:test
      [INFO]    \- log4j:log4j:jar:1.2.17:test 

      and

      [INFO] org.graphfoundation.ongdb:ongdb-slf4j:jar:1.0.1-SNAPSHOT
      [INFO] \- org.slf4j:slf4j-log4j12:jar:1.7.25:test
      [INFO]    \- log4j:log4j:jar:1.2.17:test 

       

      Resolution Steps

      1. Upgrade slf4j-log4j12 and apacheds-server-integ
      2. Update all org.slf4j group artifacts to version 1.7.36
      3. Update apacheds-server-integ to version 2.0.0-M24
      4. Add log4j exclusion to apacheds-server-integ
      5. Use reload4j (relocated log4j project) by changing dependency slf4j-log4j12 to slf4j-reload4j

      Attachments

        Activity

          People

            bradnussbaum Brad Nussbaum
            bradnussbaum Brad Nussbaum
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: