[
https://issues.apache.org/jira/browse/NIFI-9505?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17462253#comment-17462253
]
ASF subversion and git services commented on NIFI-9505:
-------------------------------------------------------
Commit bda48b3f87ad11ffcee54cd465ae6384c26fa3f1 in nifi's branch
refs/heads/main from David Handermann
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=bda48b3 ]
NIFI-9504 Upgraded Logback from 1.2.8 to 1.2.9
NIFI-9505 Upgraded Log4j 2 from 2.16.0 to 2.17.0
Signed-off-by: Chris Sampson <chris.sampso...@gmail.com>
This closes #5615
> Upgrade Log4j 2 to 2.17.0
> -------------------------
>
> Key: NIFI-9505
> URL: https://issues.apache.org/jira/browse/NIFI-9505
> Project: Apache NiFi
> Issue Type: Bug
> Reporter: David Handermann
> Assignee: David Handermann
> Priority: Minor
>
> Log4j 2 version 2.17.0 addresses a potential vulnerability in non-standard
> logging configurations using Thread Context Map lookup capabilities,
> described in [CVE-2021-45105|https://www.cve.org/CVERecord?id=CVE-2021-45105].
> Although NiFi does not use Log4j 2 for runtime logging, upgrading to version
> 2.17.0 avoids potential references to older versions in external components.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
