Critical vulnerability in log4j may affect generated PEAR projects
Impact
UIMA PEAR projects that have been generated with the de.averbis.textanalysis:pear-archetype version 2.0.0 have a maven dependency with scope test to log4j 2.8.2 and might be affected by CVE-2021-44228.
Patches
-
The issue has been resolved in
de.averbis.textanalysis:pear-archetypeversion2.0.1. Please make sure to usede.averbis.textanalysis:pear-archetypeversion >=2.0.1for generating new PEAR projects. -
Existing maven PEAR projects can be patched by manually upgrading to
log4j>=2.16.0inpom.xml.
References
https://www.lunasec.io/docs/blog/log4j-zero-day/
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/averbis/pear-archetype/issues
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | de.averbis.textanalysis:pear-archetype | >= 2.0.0, < 2.0.1 | 2.0.1 |
References
- Weakness (CWE)
-- Platform
- Java / Kotlin (Maven)
- Package
de.averbis.textanalysis:pear-archetype- Disclosed
- 16.12.2021
- Updated
- 11.10.2026 11:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j7c3-96rf-jrrp - CC BY 4.0
Vulnerability history: de.averbis.textanalysis:pear-archetype
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.