Ask a Question

Will SoapUI 5.6.1 be modified to download log4j 2.17.0?

SOLVED
MarkJohnsonekl
New Contributor

Will SoapUI 5.6.1 be modified to download log4j 2.17.0?

It seems to download 2.16.0 now, which is not acceptable to our security team.

6 REPLIES 6
richie
Community Hero

Hey @MarkJohnsonekl 

 

 

v2.16 of the log4j files are the ones that have had that security hole plugged.  Are you saying your security team wont allow v2.16 log4j files?

 

Cheers,

 

Rich

if this helped answer the post, could you please mark it as 'solved'? Also if you consider whether the title of your post is relevant? Perhaps if the post is solved, it might make sense to update the Subject header field of the post to something more descriptive? This will help people when searching for problems. Ta
richie
Community Hero

ignore my last -I just saw the post by KarelHusa about the latest security hole for v2.16 log4j

if this helped answer the post, could you please mark it as 'solved'? Also if you consider whether the title of your post is relevant? Perhaps if the post is solved, it might make sense to update the Subject header field of the post to something more descriptive? This will help people when searching for problems. Ta

My understanding is that 2.16.0 resolved the critical vulnerability that was introduced by 2.14, but - since then - vulnerabilities were discovered in 2.16.0, and one of these has been classified as critical.  The known vulnerabilities that exist in 2.16.0 are mediated by 2.17.0.      So, our organization only considers 2.17.0 an acceptable remediation.   

I see form another post that SoapUI OS  5.7.0 is being developed, and will include Log4J 2.17.0.   This issue can be closed

It appears that an additional flaw was found in 2.17.0 shortly after release. The current 2.17.1 is the newest version, and is considered standard requirement for us to allow Log4J on a system.

 

So, is there any information showing that SoapUI 5.7.0 will distribute with 2.17.1?

HKosova
SmartBear Alumni (Retired)

SoapUI 5.7.0 has been released:

https://github.com/SmartBear/soapui/releases

 

This version uses Log4j 2.17.1.


Helen Kosova
SmartBear Documentation Team Lead
________________________
Did my reply answer your question? Give Kudos or Accept it as a Solution to help others. ⬇️⬇️⬇️
cancel
Showing results for 
Search instead for 
Did you mean: