docx2tex 1.7.2 has vulnerable log4j-core-2.16.0 about docx2tex HOT 6 CLOSED

No worries, thank you for the very prompt update! I see (after a short delay after sources were posted) docx2tex-1.7.3-release.zip is available and I confirm no vulnerabilities reported by logpresso-log4j2-scan-2.8.1.jar.
Fantastic open source cooperation. This is how it should work. :-)

from docx2tex.

Thank you for the report. I don't see a real attack scenario for docx2tex but will update log4j from 2.16.0 to 2.17.1 asap.

from docx2tex.

Just out of curiosity, do you run docx2tex as a Web service which could be affected by CVE-2021-45105?

from docx2tex.

This issue is fixed with v.1.7.3

from docx2tex.

Thanks for the update!
No, we don't run it as a web service. At least in our area of the US Gov, any vulnerable log4j jar files found are treated like a "live virus" and must be removed. While the "nuke it from orbit is the only way to be sure" is excessive, we must comply.

from docx2tex.

Thank you again for your report. The concern is totally reasonable, but it seems that I've lost track on the various log4j vulnerabilities at some point.

from docx2tex.