[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-12-11 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-991672999 > Agree. After reconsidering the issue, I concluded that [CVE-2019-17571](https://github.com/advisories/GHSA-2qrg-x229-3v8q) is rather a minor issue; It is only problematic only

[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-12-11 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-991672999 > Agree. After reconsidering the issue, I concluded that [CVE-2019-17571](https://github.com/advisories/GHSA-2qrg-x229-3v8q) is rather a minor issue; It is only problematic only

[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-03-04 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-790427075 @dongjinleekr when will this fix make it in to one of Kafka upstream release? thanks This is an automated

[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-03-03 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-789662902 @dongjinleekr really appreciate your guidance here. thanks for the patch. If I chose to not to move to this patch right away, can you please confirm that this vulnerabi

[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-02-26 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-786531132 thanks @dongjinleekr have you consulted Banzaicloud about this patch? This is an automated message from the Apac

[GitHub] [kafka] priyavj08 commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2

2021-02-22 Thread GitBox
priyavj08 commented on pull request #7898: URL: https://github.com/apache/kafka/pull/7898#issuecomment-783322141 > @dongjinleekr we're using strimzi/kafka / 0.21.0-kafka-2.7.0 > > Our SCA scanning Tool (JFrog XRay) found this CVE among many others (speaking of third party lib CVEs on