Vulnerability scanner flags analysis-kotlin-descriptors.jar with Log4j vulnerability

Symptoms

Confirmed affected versions: 2024.07.x, 2024.12, 2024.12.1

A vulnerability scanner flags the <TeamCity Home>\webapps\ROOT\WEB-INF\plugins\.unpacked\configs-dsl\dokka\lib\analysis-kotlin-descriptors.jar file with Log4j vulnerability.

Cause

This is a false positive.

The library used in this package is not Apache Log4j, it's org.jetbrains.intellij.deps:log4j. In 2021, due to the Log4Shell vulnerability, Log4j was repackaged without the vulnerable classes. This repackaged version is available here. It retains the same versioning as the original package, which means that if the security tool checks only the package name and version to provide known vulnerabilities for it, it may give a false positive.

Resolution

This is a false positive; no actions are needed.