[GitHub] [kafka-site] scott-confluent commented on a change in pull request #388: adding new CVEs to list

[GitBox]

scott-confluent commented on a change in pull request #388:
URL: https://github.com/apache/kafka-site/pull/388#discussion_r769105156



##########
File path: cve-list.html
##########
@@ -9,6 +9,70 @@ <h1>Apache Kafka Security Vulnerabilities</h1>
 
 This page lists all security vulnerabilities fixed in released versions of 
Apache Kafka.
 
+<h2><a 
href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228";>CVE-2021-44228</a>
+  Flaw in Apache Log4j logging library in versions from 2.0.0 and before 
2.15.0</h2>
+
+  <p>Some components in Apache Kafka use <code>Log4j-v1.2.17</code>  there is 
no dependence on <code>Log4j v2.*</code></p>
+  
+  <p><a 
href="https://logging.apache.org/log4j/2.x/manual/lookups.html";>Lookups 
feature</a> was introduced in Log4j v2.x in order to allow specifying Log4j 
configuration parameters in arbitrary locations (even outside of the 
configuration files). Log4j v1.x does not offer the same functionality and thus 
is not vulnerable to <a 
href="https://access.redhat.com/security/cve/cve-2021-44228";>CVE-2021-44228</a>.</p>
+  <p>Users should NOT be impacted by this vulnerability</p>
+  
+  <table class="data-table">
+  <tbody>
+    <tr>
+      <td>Versions affected</td>
+      <td>org.apache.logging.log4j:log4j-core &gt;=2.0-beta9 and &lt; 
2.15.0</td>
+    </tr>
+    <tr>
+      <td>Fixed versions</td>
+      <td>NA</td>
+    </tr>
+    <tr>
+      <td>Impact</td>
+      <td>NA</td>
+    </tr>
+    <tr>
+      <td>Issue announced</td>
+      <td>09 Dec 2021</td>
+    </tr>
+  </tbody>
+  </table>
+
+<h2><a 
href="https://access.redhat.com/security/cve/CVE-2021-4104";>CVE-2021-4104</a>
+  Flaw in Apache Log4j logging library in versions 1.x</h2>
+  
+  <p>The following components in Apache Kafka use <code>Log4j-v1.2.17</code>: 
broker, controller, zookeeper, connect, mirrormaker and tools. Clients may also 
be configured to use <code>Log4j-v1.2.17</code>.</p>

Review comment:
       Updated. Thanks for clarifying




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@kafka.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org