Package
airflow-3
Component
log4j-core
Latest update
Fixed version
3.2.0-r0
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
3.2.0-r0Status
Impact
The log4j-core dependency is introduced transitively via the Ray Python package. The latest Ray release still depends on the vulnerable log4j-core version 2.17.1 (see https://github.com/ray-project/ray/blob/6dc66d4b7da62e93093b98190c064d50d5c1905f/java/dependencies.bzl#L24). To remediate GHSA-vc5p-v9hr-52mj, Ray maintainers must upgrade log4j-core to a patched version, after which Airflow maintainers will need to consume the updated Ray release.
Status
Fixed version
3.2.0-r0Status
Impact
The log4j-core dependency is introduced transitively via the Ray Python package. The latest Ray release still depends on the vulnerable log4j-core version 2.17.1 (see https://github.com/ray-project/ray/blob/6dc66d4b7da62e93093b98190c064d50d5c1905f/java/dependencies.bzl#L24). To remediate GHSA-vc5p-v9hr-52mj, Ray maintainers must upgrade log4j-core to a patched version, after which Airflow maintainers will need to consume the updated Ray release.
Status
Fixed version
3.2.0-r0Status
Impact
The log4j-core dependency is introduced transitively via the Ray Python package. The latest Ray release still depends on the vulnerable log4j-core version 2.17.1 (see https://github.com/ray-project/ray/blob/6dc66d4b7da62e93093b98190c064d50d5c1905f/java/dependencies.bzl#L24). To remediate GHSA-vc5p-v9hr-52mj, Ray maintainers must upgrade log4j-core to a patched version, after which Airflow maintainers will need to consume the updated Ray release.
Status