| Spinster | |
| Dec 22 2021, 8:18 AM |
| F34899582: image.png | |
| Dec 29 2021, 1:38 PM |
OpenRefine has very recently released a 3.5.1 version due to the recent log4j vulnerabilities. It's probably a good idea to upgrade our OpenRefine instance on PAWS as well.
(According to discussion on the OpenRefine mailing list, OpenRefine 3.5.0, which is the current version on PAWS, shipped with log4j 1.2.16, which was allegedly not affected by the vulnerability?)
All for the upgrade but just for the record I don't see a path for exploitation here. All requests to openrefine go through the proxy and only authenticated requests pass. And if you're authenticated into a user server, well RCE is the main feature for jupyterhub.
When I load OpenRefine on PAWS, it still asks to upgrade to 3.5.1 so I have the impression that this task is not resolved yet.
