{"id":"GHSA-j7c3-96rf-jrrp","aliases":[],"status":"published","title":"Critical vulnerability in log4j may affect generated PEAR projects","description":"### Impact\nUIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.\n\n### Patches\n- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version \u003e= `2.0.1` for generating new PEAR projects.\n\n- Existing maven PEAR projects can be patched by manually upgrading to `log4j` \u003e= `2.16.0` in `pom.xml`.\n\n\n### References\nhttps://www.lunasec.io/docs/blog/log4j-zero-day/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/averbis/pear-archetype/issues","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-12-16T21:01:51Z","modified":"2023-01-09T05:05:27Z","fixes":[{"ecosystem":"Maven","package":"de.averbis.textanalysis:pear-archetype","fixed_in":["2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"de.averbis.textanalysis:pear-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Maven","package":"de.averbis.textanalysis:pear-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]}],"references":[{"url":"https://github.com/averbis/pear-archetype/security/advisories/GHSA-j7c3-96rf-jrrp","tags":["web"]},{"url":"https://github.com/averbis/pear-archetype/commit/6815f5981c836ab8c345a6ff54f29e9f4b67f7eb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j7c3-96rf-jrrp"},{"url":"https://github.com/averbis/pear-archetype","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-j7c3-96rf-jrrp","title":"Critical vulnerability in log4j may affect generated PEAR projects","description":"### Impact\nUIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.\n\n### Patches\n- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version \u003e= `2.0.1` for generating new PEAR projects.\n\n- Existing maven PEAR projects can be patched by manually upgrading to `log4j` \u003e= `2.16.0` in `pom.xml`.\n\n\n### References\nhttps://www.lunasec.io/docs/blog/log4j-zero-day/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/averbis/pear-archetype/issues\n","status":"published","published":"2021-12-16T21:01:51Z","modified":"2023-01-09T05:05:27Z","updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-j7c3-96rf-jrrp","title":"Critical vulnerability in log4j may affect generated PEAR projects","description":"### Impact\nUIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.\n\n### Patches\n- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version \u003e= `2.0.1` for generating new PEAR projects.\n\n- Existing maven PEAR projects can be patched by manually upgrading to `log4j` \u003e= `2.16.0` in `pom.xml`.\n\n\n### References\nhttps://www.lunasec.io/docs/blog/log4j-zero-day/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/averbis/pear-archetype/issues\n","status":"published","published":"2021-12-16T21:01:51Z","modified":"2021-12-16T18:57:47Z","updated_at":"2026-11-02T15:46:49.977351Z"}]}}