Is there a log4j vulnerability in utPLSQL-cli? #203
Description
The lib supplied with the latest release slf4j-api 1.7.26.jar allows a possibility of a log4j attack.
https://www.slf4j.org/log4shell.html
How is this being addressed?
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Milestone
Relationships
Development
Participants
Activity
pesse commentedon Feb 4, 2022
Thanks for bringing this up.
Will provide an update as soon as possible.
However, in order to exploit Log4shell here, you'd need access to the database the cli is run against and create a test with a malicious name.
Possible, but very unlikely.
drumbeg commentedon Mar 3, 2022
Any update on the log4j issue?
jgebal commentedon Mar 13, 2022
How would you see the log4j issue to be exploited in this software?
We will definitely update the log4j library or remove it at some point when working on new features/bugfixes for cli.
I'm not sure however if there is real value in fixing it by itself.
Does it block you in any way at the moment?
Update dependencies