Repository navigation
Mitigations for log4j vulnerability in Gradle builds #19300
Description
Activity
side note - but an interesting feature would be the ability to ensure that certain libraries/versions with vulnerabilities are not a part of the build - and if they are somehow introduced - fail the build.
- added 12 commits that reference this issue
on Dec 13, 2021 Can't find a repo for the Gradle build-cache-node, so I report this here: Version 10.1, released Dec. 13th, also still ships with
log4j2 2.15.0.side note - but an interesting feature would be the ability to ensure that certain libraries/versions with vulnerabilities are not a part of the build - and if they are somehow introduced - fail the build.
@ZakTaccardi That's already possible with dependency constraints, see https://blog.gradle.org/log4j-vulnerability and https://threadreaderapp.com/thread/1470845889166159873.html
Reacted by Tres Pittman
A RCE vulnerability in log4j has been found that affects certain combinations of Java and applications using log4j 2.
This is a critical vulnerability that is actively being exploited.
While Gradle itself is not directly impacted by this, we should provide some mitigations and recommendations for Gradle users.
The following has been done in Gradle:
log4j-coreto2.16.0on the zinc compiler classpath when using the scala plugin.and requires2.16.0`More information on our blog post.