[
https://issues.apache.org/jira/browse/LOG4J2-3208?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17457763#comment-17457763
]
ASF subversion and git services commented on LOG4J2-3208:
---------------------------------------------------------
Commit c362aff473e9812798ff8f25f30a2619996605d5 in logging-log4j2's branch
refs/heads/release-2.x from Ralph Goers
[ https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=c362aff ]
LOG4J2-3208 - Disable JNDI by default
> Disable JNDI by default
> -----------------------
>
> Key: LOG4J2-3208
> URL: https://issues.apache.org/jira/browse/LOG4J2-3208
> Project: Log4j 2
> Issue Type: Story
> Components: Core
> Affects Versions: 2.15.0
> Reporter: Ralph Goers
> Priority: Major
> Fix For: 2.15.1
>
>
> Dealing with CVE-2021-4422 has shown the JNDI has significant security
> issues. While we have mitigated what we are aware of it would be safer for
> users to completely disable it by default, especially since the large
> majority are unlikely to be using it. Those who are will need to specify
> -Dlog4j2.enableJndi=true or the environment variable form of it to use any
> JNDI components.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
