log4j library security issue

[Aditi Gulati]

Hello,

As you may be aware that there is a high security risk with log4j logging library for those using library version < 2.15:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

We noticed in our local cBioportal installation the following:

~/cbioportal/portal/target/portal/WEB-INF/lib/apache-log4j-extras-1.1.jar
~/cbioportal/portal/target/portal/WEB-INF/lib/log4j-1.2.16.jar
~/cbioportal/portal/target/portal/WEB-INF/lib/slf4j-log4j12-1.7.30.jar

I wonder what are the possible solutions such as upgrading to log4j 2.15?

Many thanks

[Pim van Nierop]

Hello Aditi,

Only version >=2 have the feared exploit in log4j-core. cBioPortal uses version 1.2 and is there for not affected by said exploit. However, from cBioPortal version 3.7.21 on cBioPortal will use the 2.16.0 version of log4j. Note that log4j 2.15.0 does not fully correct the problem, hence the update to 2.16.0.

All the best,
pim 

--
You received this message because you are subscribed to the Google Groups "cBioPortal for Cancer Genomics Discussion Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cbioportal+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/cbioportal/b6a00baf-4f49-4427-b00d-2cc715f6924fn%40googlegroups.com.

--

Pim van Nierop

Software Engineer / cBioPortal specialist

E p...@thehyve.nl

T +31(0)30 700 9713

M +31(0)6 29464525

W thehyve.nl

    

[Syed Haider]

Hi Pim,

Any estimates on when v3.7.21 is scheduled for release?

[Ino de Bruijn]

We are hoping next week. We are still testing the release

Best wishes

Ino

To view this discussion on the web visit https://groups.google.com/d/msgid/cbioportal/5e8f321a-03db-48ea-b517-424e67b3131an%40googlegroups.com.

[Pablo Arce Garcia]

Hi

Just in case you missed it, 2.16.0 was discovered to be still vulnerable and 2.17.0 was released to remediate that.

Regards

Pablo

[Aaron Lisman]

Hi Pablo, 

Thanks for the alert .  We just yesterday released a portal version with upgrade to 2.17.0. 

Aaron

To view this discussion on the web visit https://groups.google.com/d/msgid/cbioportal/d7ae6fb0-4849-43f3-906e-f89624b9e688n%40googlegroups.com.