Change:
outputHashMode = "recursive"; # Downloaded jars differ by platform outputHash = { <del> x86_64-linux = "/gJFoT+vvdSWr33oI44XiZXlFfyUjtRVB1M6CMzSztM="; aarch64-linux = "v71stMWBbNALasfGAHvsVTBaDOZfpKK3sQrjNJ6FG1A="; </del> <ins> x86_64-linux = "sha256-Tn0x5MJJMe04Du+eFGAkdvh/7Sgb7pf2FtBiRyCvjo8="; aarch64-linux = "sha256-T/Cj/QxlW48xW6l+O3K4fFA19fulOB8nk9dRoiP1sys="; </ins> }.${stdenv.system} or (throw "Unsupported platform"); }; in stdenv.mkDerivation rec { inherit pname src version postPatch; <del> patches = [ ./gradle-plugin.patch ]; </del> <ins> patches = [ ./gradle-plugin.patch log4j-update-cve-2021-44228 ]; </ins> buildPhase = '' runHook preBuild

Discussion:
I used to find instances of log4j v2 (possibly affected by CVE-2021-). Packages listed below contain a log4j jar. Note that shipping the log4j jar does not imply vulnerability nor exploitability. This list is not exhaustive for many reasons (using 21.11 as index; packages not cached thus not indexed). Not vulnerable means I believe 21.05/21.11/unstable is not affected. Status ------ Fixed - 21.05? Upstream fix , not packaged Upstream fix , not packaged Fixed Fixed Fixed Upstream fix - Fixed Fixed , not packaged Not vulnerable (missing 21.05 backport) Upstream: Jitsi-videobridge instances older than 2.1-504 (May 2021) with callstats enabled should be updated to 2.1-504 or newer () Fixed Fixed Fixed Fixed Fixed Fixed 8.11.1 (2.16.0), not packaged - mitigated by adding  to your configuration Upstream (2.17.0), but unreleased Upstream (2.17.0) but Fixed (2.15.0) (no 2.17.0 released planned ) Not vulnerable Mitigated
Will patch pkgs.signald tonight.
Would it be possible to hook a scanner like into some postInstall-Hook for all packages depending on JDK? Or maybe directly into Hydra?
As soon as a new release of Jmeter is released, I'm going to update it.
I a note on how to mitigate the attack for .
Note that the Log4J maintainers have made additional releases (2.16.0 and 2.12.2) which are now as the fix for CVE-2021- (instead of 2.15). It fixes a (less severe) denial of service (CVE-2021-) and disables JNDI by default. Most downstream consumers will probably make yet another release...
I'm working on updating ELK 7 and should have a PR ready soon.
PR for Jmeter already submitted (). It will probably fix too, since log4j is running version.

I currently don't have time to go through all pull requests and update the table, but it's important to note that the second CVE has had its severity raised and various bypasses for the fixes in 2.15 have surfaced; version 2.15 still appears to be susceptible to RCE depending on the exact configuration/deployment. Packages should be upgraded to log4j2 2.16 (or 2.12.2) to be considered fixed. Also note for mitigation have been updated (deleting the JNDI class instead of disabling lookups through configuration). Additional reference:
Well, we will probably need to update all again soon:
Related MRs:
Another PR for Jmeter:
mediathekview might be affected. See PR
A new version of arduino with log4j fixes has been
A new version with fixes for log4j has been released for igv .
Can we close this issue or is there any open task?
From a quick look seems that Solr is the main one missing.
Let's close this. Packages should either be patched by now, otherwise they're likely to be orphaned and suffer from other issues as well. In case of Solr it looks like it has plenty of vulnerability tags slapped onto it.