Log4j vulnerability in kafka-setup and datahub-ingestion images

Moderate

david-leifker published GHSA-wxq2-3f82-2xjj

Aug 14, 2023

Package

No package listed

Affected versions

<v0.10.1

Patched versions

>=v0.10.1

Description

Summary
The majority of Datahub images v0.9.6.1 has Maven based Critical & High vulnerabilities coming from log4j jar packages .

Jar :
Log4j 1.2.17

Details
The datahub-kafka-setup ,datahub-ingestion images are having these Critical CVEs coming from this path:
/opt/kafka/libs/log4j-1.2.17.jar

CVE-2022-23305
CVE-2022-23302
CVE-2021-4104
CVE-2022-23307

PoC
These CVEs are produced using the Aquasec scanner and these CVEs have fixed version available .

Impact

Resolution
Upgraded to latest version of upstream images as of DataHub v0.10.1

Severity

Moderate

6.7

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H