Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Apache Fuseki server dependency to permanently remove log4j security vulnerability #12

Open
mpsonntag opened this issue Dec 13, 2021 · 2 comments

Comments

@mpsonntag
Copy link
Collaborator

The log4j version (2.14.1) used in the current build of the Apache Fuseki server contains a severe security vulnerability, see logging.apache.org for details.

Upgrade the Apache Fuseki server as soon as a fixed version (dependency Log4j >= 2.15.0) is released (4.3.0 still contains the vulnerable library). The used version can be checked in fuseki-server.jar:METAINF/DEPENDENCIES.

@mpsonntag
Copy link
Collaborator Author

mpsonntag commented Dec 23, 2021

New versions (4.3.1 and 4.3.2) of the Fuseki server have been released, using the 2.15.0 and 2.16.0 version of Log4j respectively, both plugging a security vulnerability each, see logging.apache.org for details. Since yet another vulnerability in Log4j has popped up that will only be addressed with Log4j version 2.17.0, the Fuseki server will not be updated until a version is released that contains Log4j >= 2.17.0 since the severe security vulnerability has been patched in the current running version.

@mpsonntag
Copy link
Collaborator Author

The Fuseki server 4.4.0 has completely changed the frontend, moving it from individual source files into the compiled source code. The current server setup needs to be rewritten and the binary custom compiled to continue using the custom odml-query frontend changes.
To not keep the log4j issues unaddressed in the meantime, the fuseki server version has been upgraded to 4.3.2 which contains log4j v2.16.0 fixing the two main security issues with PR #14.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant