Which version of Kafka are impacted due to Log4j CVE-2021-44228?

user_9185151 0
Viewed 17026
apache-kafka log4j security
1 Answers

Update 2021-12-15

APACHE KAFKA SECURITY VULNERABILITIES has confirmed:

  1. CVE-2021-45046

Users should NOT be impacted by this vulnerability

  1. CVE-2021-44228

Users should NOT be impacted by this vulnerability

  1. CVE-2021-4104

Version 1.x of Log4J can be configured to use JMS Appender, which publishes log events to a JMS Topic. Log4j 1.x is vulnerable if the deployed application is configured to use JMSAppender.

So please check the site for details.

Update 2021-12-13

As suggested by bovine, log4j1.x may also be affected to this vulnerability.

strictly speaking, applications using Log4j 1.x may be impacted if their configuration uses JNDI. However, the risk is much lower.

please refer to this link for latest status.

Evidence for not using log4j2

By checking dependencies.gradle of Kafka:
1.0.0 and 3.0.0 both are using 1.2.17.
As the issue is affecting version from 2.0-beta9 to 2.14.1, Kafka is not affected by this security vulnerabilities.

user_79287210
Related