Vulnerabilities in pkg:maven/com.splunk.logging/splunk-library-javalogging
PACKAGEGHSA-94g7-hpv8-h9qm is a CRITICAL remote code injection vulnerability (General Security Weakness) affecting Splunk library javalogging libraries in the Maven ecosystem. The issue involves remote code injection in log4j. Remediation is available by upgrading affected packages to version 1.11.1, 1.6.2-0-0.
pkg:maven/com.splunk.logging/splunk-library-javalogging
Vulnerability advisories affecting package pkg:maven/com.splunk.logging/splunk-library-javalogging. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-94g7-hpv8-h9qm | - | CRITICAL | Remote code injection in Log4j |
GHSA-94g7-hpv8-h9qm at a Glance
How to Fix GHSA-94g7-hpv8-h9qm
To remediate this vulnerability, upgrade all affected Splunk library javalogging dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.1</version>
</dependency><dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.6.2-0-0</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=com.splunk.loggingHow to Check if You Are Affected
To determine whether your Java application is affected by GHSA-94g7-hpv8-h9qm, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=com.splunk.loggingAnalyze the terminal output to locate any version of Splunk library javalogging in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.11.1), your application is affected.
Note: The mvn dependency:tree -Dincludes=com.splunk.logging command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Splunk library javalogging, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-94g7-hpv8-h9qm Affected Splunk library javalogging Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
com.splunk.logging:splunk-library-javalogging
|
Maven |
≥ 1.7.0
< 1.11.1
|
1.11.1
|
|
com.splunk.logging:splunk-library-javalogging
|
Maven |
< 1.6.2-0-0
|
1.6.2-0-0
|
References
Frequently Asked Questions
What is GHSA-94g7-hpv8-h9qm?
Which Splunk library javalogging versions are affected?
What version fixes GHSA-94g7-hpv8-h9qm?
Is splunk-library-javalogging affected?
What CWE is associated with GHSA-94g7-hpv8-h9qm?
How can I check Maven dependencies for GHSA-94g7-hpv8-h9qm?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-94g7-hpv8-h9qm",
"modified" : "2025-08-07T14:10:22Z",
"published" : "2021-12-14T21:46:35Z",
"aliases" : [ ],
"summary" : "Remote code injection in Log4j",
"details" : "### Impact\nLogging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.\n\nMore Details:\nhttps://github.com/advisories/GHSA-jfh8-c2jp-5v3q\n\n### Patches\nVersion 1.11.1 of the Splunk Logging for Java library.\n\nThere is also a backport to version 1.6.2 released as a patch: 1.6.2-0-0.\n\n### Workarounds\nIf upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.\n\n### References\nhttps://github.com/advisories/GHSA-jfh8-c2jp-5v3q\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/splunk/splunk-library-javalogging/issues\n* Email us at [devinfo@splunk.com](mailto:devinfo@splunk.com)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "com.splunk.logging:splunk-library-javalogging"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.7.0"
}, {
"fixed" : "1.11.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "com.splunk.logging:splunk-library-javalogging"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.6.2-0-0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/splunk/splunk-library-javalogging/security/advisories/GHSA-94g7-hpv8-h9qm"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/splunk/splunk-library-javalogging"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2021-12-14T20:00:34Z",
"nvd_published_at" : null
}
}