{"document":{"category":"csaf_security_advisory","csaf_version":"2.0","title":"Log4j updated to 2.24.3 in Kestrel SIEM 7.2.419","publisher":{"category":"vendor","name":"Kestrel Security B.V.","namespace":"https://www.vandorisk.com/advisories/kestrel-security"},"tracking":{"id":"ksa-2026-001","status":"final","version":"1","initial_release_date":"2026-09-02T10:15:54.417Z","current_release_date":"2026-09-02T10:15:54.417Z","revision_history":[{"date":"2026-09-02T10:15:54.417Z","number":"1","summary":"Initial public release."}]},"distribution":{"tlp":{"label":"WHITE"}},"notes":[{"category":"summary","title":"Summary","text":"A stale build-cache record shipped log4j-core 2.14.1 metadata in the 7.2 appliance SBOM. The shipped image runs 2.24.3; build 7.2.419 removes the stale record and this advisory documents the verification."}]},"product_tree":{"branches":[{"category":"product_name","name":"Kestrel SIEM Platform","branches":[{"category":"product_version_range","name":"7.2.400 – 7.2.418","product":{"product_id":"CSAFPID-0001","name":"Kestrel SIEM Platform 7.2.400 – 7.2.418"}},{"category":"product_version_range","name":"7.2.419 and later","product":{"product_id":"CSAFPID-0002","name":"Kestrel SIEM Platform 7.2.419 and later"}}]}]},"vulnerabilities":[{"cve":"CVE-2021-44228","product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]}},{"cve":"CVE-2021-45046","product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]}}]}