Description

ghost

opened on Feb 4, 2022

The lib supplied with the latest release slf4j-api 1.7.26.jar allows a possibility of a log4j attack.

https://www.slf4j.org/log4shell.html

How is this being addressed?

Activity

1. pesse commented on Feb 4, 2022

   

   pesse

   on Feb 4, 2022

   Member

   More actions

   Thanks for bringing this up.
   Will provide an update as soon as possible.
   However, in order to exploit Log4shell here, you'd need access to the database the cli is run against and create a test with a malicious name.
   Possible, but very unlikely.
3. jgebal commented on Mar 13, 2022

   

   jgebal

   on Mar 13, 2022

   Member

   More actions

   How would you see the log4j issue to be exploited in this software?
   We will definitely update the log4j library or remove it at some point when working on new features/bugfixes for cli.
   I'm not sure however if there is real value in fixing it by itself.

   Does it block you in any way at the moment?
4. pesse

   added a commit that references this issue on Jun 9, 2022

   Update dependencies

   This issue will close once commit 79d69ff is merged into the 'develop' branch.

   79d69ff
5. pesse

   closed this as completedin #204on Jun 9, 2022

Issue actions