search

anchore / anchore-engine

A service that analyzes docker images and scans for vulnerabilities
Apache License 2.0
1.58k stars 273 forks source link

Log4j2 vulnerability fix for Anchore Engine #1342

Closed LearnitRm closed 2 years ago

LearnitRm commented 2 years ago

We deployed Anchore Engine as docker container : anchore-devsecops-anchore-engine-analyzer -- anchore-engine:v0.8.1 anchore-devsecops-anchore-engine-simplequeue -- anchore-engine:v0.8.1 anchore-devsecops-anchore-engine-api -- anchore-engine:v0.8.1 anchore-devsecops-anchore-engine-catalog -- anchore-engine:v0.8.1 anchore-devsecops-anchore-engine-policy -- anchore-engine:v0.8.1 anchore-devsecops-postgresql -- postgres:9.6.18

Is Anchore Engine impacted by recent log4j2 vulnerability CVE-2021-44228 ? If yes, what are the recommendations to get this fixed in Anchore Engine deployed to Cloud as container ?

zhill commented 2 years ago

Hi @LearnitRm ! No, Anchore Engine is not impacted by CVE-2021-44228 because it does not include any java code nor any log4j code.

LearnitRm commented 2 years ago

thankyou for the confirmation.