New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade Gradle checks for Log4j 2.17.1 #19526

Closed

ljacomet opened this issue Jan 10, 2022 · 0 comments

Assignees

Labels

in:logging in:scala-plugin

Milestone

Member

ljacomet commented Jan 10, 2022

This is a follow up on #19300 and #19360 after the report of CVE-2021-44832 which updates the internal constraints to Log4j 2.17.1.

The following has been done in Gradle:

Ensure Zinc compiler does not put a vulnerable Log4j on a classpath. This is done by upgrading log4j-core to 2.17.1 on the zinc compiler classpath when using the scala plugin.
Protect buildscript classpath from having vulnerable Log4j. This is done by adding a constraint that rejects known vulnerable versions [2.0, 2.17.1)and requires2.17.1`

More information on our blog post.

The text was updated successfully, but these errors were encountered:

ljacomet added in:logging in:scala-plugin labels

ljacomet added this to the 7.4 RC1 milestone

ljacomet self-assigned this

ljacomet mentioned this issue

Upgrade checks to Log4j 2.17.0 #19360

Closed

bot-gradle closed this as completed in

yhtMinceraft1010X mentioned this issue

Upgrade Gradle to at least 7.3 reposense/RepoSense#1661

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment