Apache’s security record for CVE-2021-44228 identifies log4j-core as the affected component. This is the 2021 issue commonly discussed as Log4Shell; the date on this thread is our discussion date.
For an inventory conversation, “uses Java” or “has logging” is not a precise enough description. I want the actual component, the packaged version, and the application build that includes it. A development dependency list can differ from the artifact that was deployed.
The useful outcome is a traceable record of what was found and where, including unresolved cases. I would rather keep an unknown entry open than close it based only on a filename.
That last point comes up with bundled dependencies. I keep the packaging context in the same note so a future reviewer knows whether the observation came from source metadata or the built artifact.
Apache’s security record for CVE-2021-44228 identifies log4j-core as the affected component. This is the 2021 issue commonly discussed as Log4Shell; the date on this thread is our discussion date.
For an inventory conversation, “uses Java” or “has logging” is not a precise enough description. I want the actual component, the packaged version, and the application build that includes it. A development dependency list can differ from the artifact that was deployed.
The useful outcome is a traceable record of what was found and where, including unresolved cases. I would rather keep an unknown entry open than close it based only on a filename.
Source reference: Apache Logging Services security advisory, CVE-2021-44228.