search

seancorfield / next-jdbc

A modern low-level Clojure wrapper for JDBC-based access to databases.
https://cljdoc.org/d/com.github.seancorfield/next.jdbc/
Eclipse Public License 1.0
755 stars 90 forks source link

Update log4j to 2.15.0 [CVE-2021-44228] #195

Closed rjsheperd closed 2 years ago

rjsheperd commented 2 years ago

Update log4j to patch for vulnerability found where arbitrary code execution can occur.

See: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

seancorfield commented 2 years ago

Since it was only a test dependency, it wasn't a vector for an attack so it was low on my list as I worked to update other libraries over the weekend but thanks for noticing it.

I've just pushed a fairly comprehensive update of several build/test dependencies that includes this.