Sonatype Product Log4j Vulnerability Status
As reported in our blog post, Sonatype is aware of the reported Apache "Log4j2" security issues (CVE-2021-44228 and CVE-2021-45046).
Note
Sonatype uses logback as the default logging solution as opposed to log4j. This means our software including Sonatype Lifecycle, Sonatype Repository Firewall, Nexus Repository OSS, and Nexus Repository Pro in versions 2.x and 3.x are NOT affected by the reported log4j vulnerabilities. We still advise keeping your software upgraded at the latest version.
Sonatype Lifecycle
Sonatype Lifecycle does not contain the vulnerable components of log4j and is not affected by CVE-2021-44228 or CVE-2021-45046. No action is necessary.
Sonatype Lifecycle primarily uses slf4j 1.x, which internally delegates to logback 1.x. Where we have dependencies that refer to log4j specifically, we use log4j-over-slf4j, which is not impacted by CVE-2021-44228 or CVE-2021-45046.
Sonatype Repository Firewall
Sonatype Repository Firewall is packaged with Sonatype IQ Server. The IQ Server is unaffected by CVE-2021-44228 or CVE-2021-45046. No action is necessary.
Nexus Repository 2 and 3
Nexus Repository does not contain the vulnerable components of log4j and is not affected by CVE-2021-44228 or CVE-2021-45046. No action is necessary.
Nexus Repository primarily uses slf4j 1.x, which internally delegates to logback 1.x. Nexus Repository does use some log4j components such as log4j-over-slf4j, but none are affected by CVE-2021-44228 or CVE-2021-45046.
Nexus Repository OSS and Pro 3.x contain an embedded instance of Elastic Search; Nexus Repository and its embedded Elastic Search instance do not contain vulnerable log4j components.
Nexus Repository Database Migrator
The Nexus Repository Database Migrator utility does not contain the vulnerable components of log4j and is not affected by CVE-2021-44228 or CVE-2021-45046. No action is necessary.
The migrator does include log4j-api 2.x (not impacted by CVE-2021-44228 or CVE-2021-45046), but not log4j-core. It uses the newer version of the log4j-over-slf4j bridge: https://logging.apache.org/log4j/2.x/log4j-to-slf4j/