Octopus-TeamCity vulnerable to CVE-2025-68161

[saschanm]

log4j-core and log4j-api version 2.15.0 is showing up on vulnerability scans.

https://nvd.nist.gov/vuln/detail/CVE-2025-68161

I have updated the plugin locally by replacing log4j with latest v2.x jar files to mitigate.
I have advised TeamCity marketplace and raised issue here.

Please update the versions in published plugin.

[smorris-mondialevgl]

New version published and still containing this vulnerability - original post should have stated current bundled version of log4j at 2.17.1 - but same vulnerability applies until v2.25.3

[smorris-mondialevgl]

New vulnerability reported in log4j v2.25.3

https://nvd.nist.gov/vuln/detail/CVE-2026-34480

Library will need to be updated to 2.25.4