Log4j critical vulnerability CVE-2021-44228 in Aspose.HTML

Brandon9595 · December 13, 2021, 7:33pm

2021-12-13_12-29-39.png (11.6 KB)

Hi @Amjad_Sahi, thank you for your response. I was doing a binary file search in eclipse and noticed that the aspose-html-18.5.jar may have had some sort of reference to log4j (screenshot included in this message). Curious if you have any idea what that is from?

Thanks in Advance,
Brandon Brown

amjad.sahi · December 13, 2021, 7:36pm

@Brandon9595,

As we recommend using latest version of the APIs, so could you please try our latest version of Aspose.HTML for Java and let us know your feedback.

Brandon9595 · December 13, 2021, 7:40pm

@Amjad_Sahi,

I included the latest 21.6 aspose.html jar file and re-ran the search and it still seems to be picking up on some sort of log4j referenceaspose.png (21.3 KB)

amjad.sahi · December 14, 2021, 8:53am

@Brandon9595,

Thanks for sharing the screenshot.

We will evaluate it and get back to you soon.

Brandon9595 · December 14, 2021, 3:18pm

@Amjad_Sahi Thank you. Looking forward to your response.

asad.ali · December 14, 2021, 8:00pm

@Brandon9595

Please note that Aspose.HTML for Java 21.11 does not use Log4j library. It was only meant to hide the obfuscation. However, it was never used in the API as it is only a transitive dependency.