{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "de.averbis.textanalysis:pear-archetype"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-16T18:57:47Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\nUIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.\n\n### Patches\n- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version \u003e= `2.0.1` for generating new PEAR projects.\n\n- Existing maven PEAR projects can be patched by manually upgrading to `log4j` \u003e= `2.16.0` in `pom.xml`.\n\n\n### References\nhttps://www.lunasec.io/docs/blog/log4j-zero-day/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/averbis/pear-archetype/issues\n",
  "id": "GHSA-j7c3-96rf-jrrp",
  "modified": "2021-12-16T18:57:47Z",
  "published": "2021-12-16T21:01:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/averbis/pear-archetype/security/advisories/GHSA-j7c3-96rf-jrrp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/averbis/pear-archetype/commit/6815f5981c836ab8c345a6ff54f29e9f4b67f7eb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/averbis/pear-archetype"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Critical vulnerability in log4j may affect generated PEAR projects"
}