[MDEP-792] Log4j vulnerability dependencies getting downloaded during the Maven build process

[jira-importer]

Abhishek Patnaik opened MDEP-792 and commented

We are using Maven as a build tool for MuleSoft application using Jenkins.

As part of log4j2 vulnerability scan reports, the MuleSoft Jenkins build servers got listed.

We verified application Jar file not referring these older versions of log4j.

Below are the findings when we use 3.6.3 and 3.8.4 versions of maven.

Before running the build, we have already clean-up the /tmp & /.m2.
| |Maven 3.6.3|After upgrade Maven 3.8.4|
|log4j|2.11.2
2.13.1
2.17.1
2.9.1|2.11.2
2.13.1
2.17.1
2.9.1|
|log4j-1.2-api|2.13.1|2.13.1|
|log4j-api|2.13.1
2.17.1
2.9.1|2.13.1
2.17.1
2.9.1|
|log4j-core|2.13.1
2.17.1
2.9.1|2.13.1
2.17.1
2.9.1|
|log4j-slf4j-impl|2.11.2
2.13.1
2.9.1|2.11.2
2.13.1
2.9.1|

---

Attachments:

• Log4j_Vulverability_Problem.docx (14.80 kB)

[jira-importer]

Slawomir Jaranowski commented

How it is connected with maven-dependency-plugin?
Which version maven-dependency-plugin are you use?
Can you provide minimal example project to reproduce this issue?

[jira-importer]

Michael Osipov commented

apatnaik, as far as I can see you are already vulnerable and your system has been compromised. The ransom will be requested in the next couple of days. Contact your treasurer to get funds.