GHSA-j7c3-96rf-jrrp Critical vulnerability in log4j may affect generated PEAR projects
Attackers can execute arbitrary code via Log4j in generated PEAR projects, requiring developers to upgrade the archetype or Log4j dependency.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j7c3-96rf-jrrp?
GHSA-j7c3-96rf-jrrp is a code injection vulnerability in de.averbis.textanalysis:pear-archetype, published on 16 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
UIMA PEAR projects that have been generated with the de.averbis.textanalysis:pear-archetype version 2.0.0 have a maven dependency with scope test to log4j 2.8.2 and might be affected by CVE-2021-44228.
Patches
The issue has been resolved in
de.averbis.textanalysis:pear-archetypeversion2.0.1. Please make sure to usede.averbis.textanalysis:pear-archetypeversion >=2.0.1for generating new PEAR projects.Existing maven PEAR projects can be patched by manually upgrading to
log4j>=2.16.0inpom.xml.
References
https://www.lunasec.io/docs/blog/log4j-zero-day/
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/averbis/pear-archetype/issues
Which versions are affected by GHSA-j7c3-96rf-jrrp?
2 open source packages ship an affected version, including de.averbis.textanalysis:pear-archetype.
| Package | Affected | Fixed in |
|---|---|---|
de.averbis.textanalysis:pear-archetype Maven | From 2.0.0 | 2.0.1 |
de.averbis.textanalysis:pear-archetype Maven | From 2.0.0 | 2.0.1 |
How do I fix GHSA-j7c3-96rf-jrrp?
Upgrade de.averbis.textanalysis:pear-archetype to 2.0.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-j7c3-96rf-jrrp being exploited?
There is no known exploitation of GHSA-j7c3-96rf-jrrp in the wild and no public exploit code.