Repository navigation
Is keycloak docker affected by CVE-2021-45105 DOS vulnerability? #9367
Unanswered
snehil2112
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
Keycloak has started a discussion regarding CVE-2021-44228 saying that the library is not affected by the vulnerability.
But there is no mention about the new vulnerability CVE-2021-45105 which affects log4j version upto 2.16 and apache suggests to update the version of log4j to 2.17.
I am running the latest docker images of keycloak which has log4j version 2.15:
/opt/jboss/keycloak/modules/system/layers/base/org/jboss/log4j/logmanager/main/log4j-jboss-logmanager-1.2.2.Final.jar
/opt/jboss/keycloak/modules/system/layers/base/org/jboss/logmanager/log4j2/main/log4j2-jboss-logmanager-1.0.0.Final.jar
/opt/jboss/keycloak/modules/system/layers/base/org/apache/logging/log4j/api/main/log4j-api-2.15.0.jar
Kindly confirm if the keycloak docker is affected by the vulnerability and if yes, what is the fix for this?
All reactions