Projects using log4j 2.12.1 are affected by CVE-2021-44228, but are not detected yet.

[qianwch]

It is clear that my projects are using log4j 2.12.1, but dependency track could not detect VULs about CVE-2021-44228. What could we do to solve this?

[stevespringett]

OSS Index is not properly identifying the vulnerability on 2.12.2, but is identifying it on 2.12.1.
https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j-core@2.12.2
https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j-core@2.12.1

Please report these issues to OSS Index. Once resolved, DT will correctly identify it.
https://ossindex.sonatype.org/doc/report-vulnerability

[qianwch]

It is version 2.12.1，I just mistyped..

.

[stevespringett]

log4j-api is not vulnerable. It provides an API contract, but no code implementations. log4j-to-slf4j is a bridge between two logging frameworks. To my knowledge, log4j-core is the only module that is vulnerable.

[officerNordberg]

This looks fine to me, the vuln is in log4j-core, if logs are being bridged to slf4j who can say what the implementation is. Correctly not reported.

…

On Tue, Dec 14, 2021 at 9:02 PM qianweichun ***@***.***> wrote: It is version 2.12.1，I just mistyped.. [image: 截屏2021-12-15 上午10 59 40] <https://user-images.githubusercontent.com/45196316/146115349-941e2659-8883-491d-8db5-f20ce0ef7f8c.png> . — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1300 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAG4CXUKVOLHNUDSHY6AUEDURAAMXANCNFSM5KCQBT2Q> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[savujevi]

I have uploaded a sbom to dependencytrack including pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3.

There is no vulnerability found.

It looks like the identifier is present:
https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3

Sonatype OSS Index is on.

I see nothing special in the logfile:

10:17:00.876 INFO [OssIndexAnalysisTask] Starting Sonatype OSS Index analysis task 10:17:04.945 INFO [OssIndexAnalysisTask] Sonatype OSS Index analysis complete 10:17:04.947 INFO [PolicyEngine] Evaluating 522 component(s) against applicable policies 10:17:06.353 INFO [PolicyEngine] Policy analysis complete 10:17:06.358 INFO [MetricsUpdateTask] Executing metrics update for project: 619c700e-9330-4c9f-9ac1-22d1517203e7 10:17:17.150 INFO [MetricsUpdateTask] Completed metrics update for project: 619c700e-9330-4c9f-9ac1-22d1517203e7

Generely vulnerabilities are found:

Do I miss something ?

Thank you for your help.

[stevespringett]

The vulnerability could also be identified as f0ac54b6-9b81-45bb-99a4-e6cb54749f9d

[savujevi]

Does anyone have checked a log4j-core 2.x in dependency-track only to check if my installation is ok or not.
Thanks.

[stevespringett]

Dependency-Track does not use log4j

[savujevi]

I have expressed myself in a misleading way.

I mean that I have uploaded a sbom from an apllication of us in dependency-track with pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3 included, but this log4j-core finding does not appear in the audit vulnerabilities as you can see in the pictures.

The question is if I have installed something wrong according to the images I have posted.

If I follow the link https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j-core@2.13.3 I get a result, but this result is not present in dependency-track in my project.

I am not asking if dependency-track uses log4j.

Thank you for your help.

[savujevi]

Now the vulnerability for log4j is shown. Strange. Maybe a timing problem or just a restart ..
Sorry for the noise and thank you for your help and the great work.