What is GHSA-j7c3-96rf-jrrp?

GHSA-j7c3-96rf-jrrp is a security advisory published by GitHub Security Advisories with Critical severity. Critical vulnerability in log4j may affect generated PEAR projects

Why does GHSA-j7c3-96rf-jrrp have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-j7c3-96rf-jrrp?

GHSA-j7c3-96rf-jrrp affects 1 product, including: maven/de.averbis.textanalysis:pear-archetype:= 2.0.0.

GHSA-j7c3-96rf-jrrpCriticalDisclosed before NVD

Critical vulnerability in log4j may affect generated PEAR projects

Vendor

GitHub Security Advisories

Published

December 16, 2021

Last Modified

January 9, 2023

📋 Description

Impact

UIMA PEAR projects that have been generated with the de.averbis.textanalysis:pear-archetype version 2.0.0 have a maven dependency with scope test to log4j 2.8.2 and might be affected by CVE-2021-44228.

Patches

The issue has been resolved in de.averbis.textanalysis:pear-archetype version 2.0.1. Please make sure to use de.averbis.textanalysis:pear-archetype version >= 2.0.1 for generating new PEAR projects.
Existing maven PEAR projects can be patched by manually upgrading to log4j >= 2.16.0 in pom.xml.

References

https://www.lunasec.io/docs/blog/log4j-zero-day/

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/averbis/pear-archetype/issues

🎯 Affected products1

maven/de.averbis.textanalysis:pear-archetype:= 2.0.0