GitLab addresses Log4j vulnerabilities with security updates

This post details the specific actions taken to address the Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832) by updating dependency scanning and SAST analyzers to use the latest Log4j versions (2.17.1) and removing Log4j as a dependency from the license scanning analyzer. It confirms that default configurations for SAST and Dependency Scanning are patched and provides recommended actions for customers running older versions or modified configurations, as well as for self-managed customers in offline environments. It also clarifies the low impact of CVE-2021-44832 and CVE-2021-45105 on the GitLab platform.