CVE-2021-45046/GHSA-7rjr-3q55-vv33 backport to 2.3.x is not reported on GHSA advisory

[noren95]

Hi log4j team -
I was invetigating this CVE's affected scope, and I've noticed that the fix was backported to 2.3.x branch.

Log4j advisory reports its fixed in 2.3.1. https://logging.apache.org/security.html#CVE-2021-45046
Also reflected in changelog rel/2.3...rel/2.3.1

This is not reflected in the GHSA affected range, and raises False Positive on dependency scanning.
I have opened this PR on GHSA but haven't got a response yet - could someone please confirm this?
github/advisory-database#8692

I appreciate you help, thank you!

[ppkarwasz]

Hi @noren95,

You can cite apache/logging-site#6 as the source of the data (it contains the commits that fixed each CVE), however the reason GitHub hasn't reviewed your PR yet is not that it need additional information, but that as far as I know the team has about 2 months of backlog reviewing CVEs.

[noren95]

Thank you @ppkarwasz
I will keep tracking your discussion there as well.