Miggo Logo
Miggo Vulnerability Database
→
GHSA-j7c3-96rf-jrrp

GHSA-j7c3-96rf-jrrp: Critical vulnerability in log4j may affect generated PEAR projects

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-j7c3-96rf-jrrp
EPSS Score
-
CWE
-
Published
12/16/2021
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
de.averbis.textanalysis:pear-archetypemaven= 2.0.02.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using log4j 2.8.2 as a dependency, which contains the Log4Shell (CVE-2021-44228) vulnerability. The PEAR archetype itself does not contain vulnerable code functions - the risk comes from projects inheriting the vulnerable log4j dependency through their pom.xml. The actual vulnerable functions exist within log4j's JNDI lookup features (e.g., JndiLookup class), not in the pear-archetype codebase. The fix involves updating the dependency version, not modifying application code. No specific functions in the pear-archetype package were identified as vulnerable with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t UIM* P**R proj**ts t**t **v* ***n **n*r*t** wit* t** `**.*v*r*is.t*xt*n*lysis:p**r-*r***typ* ` v*rsion `*.*.*` **v* * m*v*n **p*n**n*y wit* s*op* `t*st` to` lo**j *.*.*` *n* mi**t ** *****t** *y *V*-****-*****. ### P*t***s - T** issu* **s

Reasoning

T** vuln*r**ility st*ms *rom usin* `lo**j` *.*.* *s * **p*n**n*y, w*i** *ont*ins t** Lo**S**ll (*V*-****-*****) vuln*r**ility. T** P**R *r***typ* its*l* *o*s not *ont*in vuln*r**l* *o** *un*tions - t** risk *om*s *rom proj**ts in**ritin* t** vuln*r**