alibaba/Sentinel

There is a vulnerability in log4j 1.2.14,upgrade recommended

Open

#1,997 opened on Feb 1, 2021

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Java (8,150 forks)batch import
area/dashboarddependenciesgood first issue

Repository metrics

Stars
 (23,109 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

https://github.com/alibaba/Sentinel/blob/1f4614c0d4c5e966de1cd9f6715c8220937ef2a9/sentinel-dashboard/pom.xml#L67

CVE-2019-17571 CVE-2020-9488

Recommended upgrade version： 2.0~beta9-1

Contributor guide

Research direction
Update the log4j dependency version in the pom.xml file to a non vulnerable version (e.g., 2.17.0 or higher) to mitigate CVE 2019-17571 and CVE 2020-9488.
Tech stack
java
Domain
securitybackend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaMaven
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80