[CentOS] log4j cve

Tue Dec 14 15:28:49 UTC 2021
Markus Falb <wnefal at gmail.com>

On Tue, 2021-12-14 at 14:31 +0100, Steve Meier wrote:
> Hello Steve,
> Am 2021-12-14 14:14, schrieb Steve Clark:
> >  This is the standard version that comes with CentOS 7 and is the
> > latest available as of a yum update just now.
> > log4j-1.2.17-16.el7_4.noarch
> yes, that's correct, but it is abandoned nonetheless.
> According to the RPM's change log, Red Hat backported a fix for 
> CVE-2017-5645.
> They have not done this for CVE-2019-17571 it seems.
> I would be very surprised if they'd do so now.

https://access.redhat.com/node/4677071According to that link CVE-2019-17571 is the same issue as CVE-2017-
5645 and both are listed as fixed in this errata:

So I think it's fixed.
Best regards, markus