Mac Hale created MNG-7441:
-----------------------------
Summary: Update Version of Logback to Address CVE-2021-42550
Key: MNG-7441
URL: https://issues.apache.org/jira/browse/MNG-7441
Project: Maven
Issue Type: Bug
Components: Dependencies
Affects Versions: 3.8.5
Reporter: Mac Hale
[CVE-2021-42550|https://nvd.nist.gov/vuln/detail/CVE-2021-42550] is present in
Logback versions 1.2.7 and earlier. Maven uses v 1.2.1. Please update to
Logback 1.2.9, which includes a fix as per
[https://jira.qos.ch/browse/LOGBACK-1591|[https://jira.qos.ch/browse/LOGBACK-1591].]
I see ch.qos.logback 1.2.1 in {{./pom.xml}} and ch.qos.logback without a
version specified in {{./maven-embedder/pom.xml}}
But I'm no expert on this code base so it's possible there are other versioned
references.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
