garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-993449177
Good tips Philip! >It just does not sound right that the only log4j team answer is "migrate to 2.x or try removing class files from jars". How does "unpaid volunteer" sound? ;-) Gary On Tue, Dec 14, 2021 at 6:21 AM Philip Whitehouse ***@***.***> wrote: > I see a lot of comments that "log4j 1.x has reached its end of life". > However, is there a chance there will be log4j 1.2.18 that just removes the > offending features (e.g. JMSAppender, JmsSink, Chainsaw, SocketServer, > SocketNode)? > > It just does not sound right that the only log4j team answer is "migrate > to 2.x or try removing class files from jars". > > The Socket vulnerability (7.5) has been around for more than 4 years. The > SMTP vulnerability has been around for over a year. You've had ages to > migrate libraries. > > If it's important to Netcracker Tech maybe you could approach the Apache > Software Foundation and ask to maintain Log4J 1. > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <https://github.com/apache/logging-log4j2/pull/608#issuecomment-993440874>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAJB6N2TBRUZY3I6L4MEKMLUQ4SBPANCNFSM5JA3ZEGA> > . > Triage notifications on the go with GitHub Mobile for iOS > <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> > or Android > <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. > > -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifications-unsubscr...@logging.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
