Log4j Vulnerability (CVE-2021-44228) in Maven plugins

[danielpuiu]

Hi,

While investigating if the Maven plugins we use for configuring and deploying Apigee (https://github.com/apigee/apigee-config-maven-plugin and  https://github.com/apigee/apigee-deploy-maven-plugin) are impacted by the CVE-2021-44228 Log4j vulnerability (https://www.lunasec.io/docs/blog/log4j-zero-day/) we found out that they are not affected (the affected versions are >=2.0-beta9 and <=2.14.1).

However, the problem is that these plugins use version 1.2.17 which is End of Life (it is not maintained anymore) and has other security vulnerabilities that will not be fixed anymore.

Can these plugins be updated to reference the latest version of Log4j (2.15.0)?

Thank you in advance!