[FP]: log4j-core-2.25.3.jar CVE-2025-68161

[cvnmlr]

Package URl

pkg:maven/org.apache.logging.log4j/log4j-core@2.25.3

CPE

cpe:2.3:a:apache:log4j:2.25.3:::::::*

CVE

CVE-2025-68161

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.1.9

Description

No response

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.apache.logging.log4j</groupId>
   <artifactId>log4j-core</artifactId>
   <version>2.25.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8203
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j-core@.*$</packageUrl>
   <cpe>cpe:/a:apache:log4j</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/20576388099

[chadlwilson]

This is coming from OSSIndex, who have a deviation notice up on the vulnerability.

The Sonatype Security Research team discovered that versions after 3.0.0-alpha1 are also vulnerable, and no fix has been released for these versions. This differs from the advisory, which states that only versions between 2.0-beta9 and 2.25.3 are vulnerable.

Currently they are also marking 2.25.3 as vulnerable, which I agree does not seem correct.

You will need to contact OSSIndex to have their data corrected via https://ossindex.sonatype.org/doc/report-vulnerability if you think it is wrong; this project doesn't attempt to address debates over upstream data correctness.