bzixilu / dotplugin

Dot language plugin for Intellij IDEA
55 stars 10 forks source link

Current release bundles vulnerable log4j JAR (PyCharm) #18

Closed Purg closed 2 years ago

Purg commented 2 years ago

The current plugin when installed bundles a vulnerable version of log4j (log4j-core-2.12.0.jar). This is from the perspective of PyCharm 2021.3, plugin version 1.2 that is available on the market place. On my unix system, this was specifically located in at the path .local/share/JetBrains/PyCharm2021.3/dotplugin/lib/log4j-core-2.12.0.jar. For security reasons, I cannot use this plugin until this library is updated to a patched version.