Is kafka-avro-serializer impacted by CVE-2021-44228?

Santosh Pisapati

I am using, kafka-avro-serializer and I could not locate which version of log4j it uses internally for logging, so, I was wondering if it is impacted by the security vulnerability CVE-2021-44228? Also, which version does it use?

I checked the FAQs and the thread but I couldn't find anything specific to kafka-avro-serializer.

If the vulnerability depends on the version of kafka-avro-serializer being used, then, would really appreciate how I can identify that.

Thank you.

 

Shannon S

Hi Santosh,

Good afternoon, and thank you for raising this on Atlassian Community.

I have never heard of kafka-avro-serializer personally,, but I looked into it, and I believe you might be referring to a product called "Confluent" instead of "Confluence."

https://www.confluent.io/confluent-cloud/?_ga=2.103147848.992168864.1639579152-521892196.1639579152

Does that seem to be what you're using? If so, I recommend contacting Confluent instead:

https://www.confluent.io/contact 

I hope that helps, but let me know if you have any questions.

Shannon | Atlassian Cloud Support