Android IntelliJ core library containing log4j 1.2.17

user_9103035 0
Viewed 1335

Thanks to the CVE-2021-44228, we decided to integrate the OWASP Dependency check gradle plugin to our Android projects.

We've been surprised to see that the mentioned CVE was present in an IntelliJ dependency :

One or more dependencies were identified with known vulnerabilities in app: ... intellij-core-26.5.4.jar\META-INF/maven/log4j/log4j/pom.xml (pkg:maven/log4j/log4j@1.2.17, cpe:2.3:a:apache:log4j:1.2.17:::::::*) : CVE-2019-17571, CVE-2020-9488, CVE-2021-44228

We have three questions about it :

  • Should we be worried about this identified vulnerability ?
  • How is the intellij-core-26.5.4.jar pulled ?
  • Is this jar present in our final APK ?
maven intellij-idea log4j android java
2 Answers

IntelliJ is of course just an advanced text editor and has no relation to the android application itself, so no, I wouldn't worry. It might be an insecurity for JetBrains, though, but that's really their problem

user_20414750

CVE-2021-44228 is only applicable to Log4J2 versions 2.0-beta9 and newer upto and including 2.14.1, see: https://logging.apache.org/log4j/2.x/security.html

It does not apply to older versions such as Log4J 1.2.17.

The JAR file intellij-core-26.5.4.jar is part of IntelliJ IDEA itself, and is not something that is included with the APK of your own application when you create an Android application with IntelliJ or Android Studio.

user_1355890
Related