[
https://issues.apache.org/jira/browse/KAFKA-9366?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17511547#comment-17511547
]
Luke Chen commented on KAFKA-9366:
----------------------------------
[~brandonk] and all, we are aware of the log4j CVE issue is impacting many
users. Currently, we are discussing compatibility issue for the log4j2 upgrade,
and is considering to temporarily replace log4j with reload4j in v3.2.0. The
discussion thread is here:
https://lists.apache.org/thread/qo1y3249xldt4cpg6r8zkcq5m1q32bf1
Welcome to provide your comments and thoughts. Thanks.
> Upgrade log4j to log4j2
> -----------------------
>
> Key: KAFKA-9366
> URL: https://issues.apache.org/jira/browse/KAFKA-9366
> Project: Kafka
> Issue Type: Bug
> Components: core
> Affects Versions: 2.2.0, 2.1.1, 2.3.0, 2.4.0
> Reporter: leibo
> Assignee: Dongjin Lee
> Priority: Critical
> Labels: needs-kip
> Fix For: 3.3.0
>
>
> h2. CVE-2019-17571 Detail
> Included in Log4j 1.2 is a SocketServer class that is vulnerable to
> deserialization of untrusted data which can be exploited to remotely execute
> arbitrary code when combined with a deserialization gadget when listening to
> untrusted network traffic for log data. This affects Log4j versions up to 1.2
> up to 1.2.17.
>
> [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571]
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
