[jira] [Comment Edited] (LOGCXX-322) Crashes on exit from multithreaded program using log4cxx

2021-12-10 Thread Tobias Frost (Jira)
[ https://issues.apache.org/jira/browse/LOGCXX-322?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457553#comment-17457553 ] Tobias Frost edited comment on LOGCXX-322 at 12/11/21, 7:36 AM: At

[jira] [Commented] (LOGCXX-322) Crashes on exit from multithreaded program using log4cxx

2021-12-10 Thread Tobias Frost (Jira)
[ https://issues.apache.org/jira/browse/LOGCXX-322?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457553#comment-17457553 ] Tobias Frost commented on LOGCXX-322: - At version 12.1, I'm seeing crashes in the multithreadtest

[jira] [Commented] (LOG4J2-3204) SpringLookup not found while Interpolator initializing

2021-12-10 Thread francis (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3204?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457544#comment-17457544 ] francis commented on LOG4J2-3204: - [~vy]  I started a PR

[GitHub] [logging-log4j2] Francis-FY opened a new pull request #617: LOG4J2-3204 - Correct SpringLookup package name in Interpolator

2021-12-10 Thread GitBox
Francis-FY opened a new pull request #617: URL: https://github.com/apache/logging-log4j2/pull/617 Correct SpringLookup package name in the constructor of Interpolator -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use

[GitHub] [logging-log4j2] Marcono1234 edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Marcono1234 edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991396409 The latest Java versions are most likely still vulnerable to RCE. While they prevent loading classes from remote sources by default (`trustURLCodebase` property

[GitHub] [logging-log4j2] Marcono1234 edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Marcono1234 edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991396409 The latest Java versions are most likely still vulnerable to RCE. While they prevent loading classes from remote sources by default (`trustURLCodebase` property

[GitHub] [logging-log4j2] Firminator commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Firminator commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991418303 > Also, if this matters to you so much, why not show it with a donation to ... or this project's main contributor https://github.com/sponsors/rgoers ? Case of

[GitHub] [logging-log4j2] Marcono1234 commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Marcono1234 commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991396409 The latest Java versions are most likely still vulnerable to RCE. While they prevent loading classes from remote sources by default (`trustURLCodebase` property

[jira] [Commented] (LOG4J2-3184) Support Scala 3

2021-12-10 Thread PJ Fanning (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457488#comment-17457488 ] PJ Fanning commented on LOG4J2-3184: [~vy] Biggest problem for scala 3 is writing something to

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991387493 > When there are literally millions of log4j 1.x users out there, can you stop toying around? > > There is no lookup expansion in log4j 1.x and it does not suffer

[GitHub] [logging-log4j-scala] pjfanning opened a new pull request #5: upgrade dependencies to partially suit scala 3 build

2021-12-10 Thread GitBox
pjfanning opened a new pull request #5: URL: https://github.com/apache/logging-log4j-scala/pull/5 This is far from a full solution to having Scala 3 build working. It does upgrade some tools and libs as a baby step. Relates to https://issues.apache.org/jira/browse/LOG4J2-3184 --

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990758663 > @remkop , thanks for your reply. Just want to make it more clear, because many people reach this issue mainly for the "JNDI lookup" CVE, so, for log4j 1.x,

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 > Hi @rgoers, is log4j 1.x vulnerable? Hi @yuezk, as far as I can tell, log4j 1.x does not support lookups. ~~I also could not find any other reference to JNDI

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990661374 > @remkop Which description is correct ? @linux-ops You are asking me? Well, in my totally objective, completely unbiased opinion, there is no doubt that my

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991380319 When there are literally millions of log4j 1.x users out there, can you stop toying around? There is no lookup expansion in log4j 1.x and it does not suffer

[GitHub] [logging-log4j2] ceki commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
ceki commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991380319 When there are literally millions of log4j 1.x users out there, can you stop toying around? There is no lookup expansion in log4j 1.x and it does not suffer from

[jira] [Commented] (LOG4J2-3206) 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步

2021-12-10 Thread PJ Fanning (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3206?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457480#comment-17457480 ] PJ Fanning commented on LOG4J2-3206: [~zhengqin] you can download v2.15.0 at

[GitHub] [logging-log4j2] mdpollard commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-10 Thread GitBox
mdpollard commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r767031109 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2

[GitHub] [logging-log4j2] ahahu commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
ahahu commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991354707 I'd also like to stress, that it is not sufficient to mitigate this vulnerability by using a JRE/JDK version which prevents the RCE, nor should you rely solely on your

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991352666 Take the example as warning not to try re-enabling the disabled feature! -- This is an automated message from the Apache Git Service. To respond to the message, please log on

[GitHub] [logging-log4cxx] bowb opened a new pull request #78: LOGCXX-537 prevent double lock of mutex and restart monitor thread

2021-12-10 Thread GitBox
bowb opened a new pull request #78: URL: https://github.com/apache/logging-log4cxx/pull/78 Issue [https://issues.apache.org/jira/projects/LOGCXX/issues/LOGCXX-537](https://issues.apache.org/jira/projects/LOGCXX/issues/LOGCXX-537) -- This is an automated message from the Apache Git

[jira] [Commented] (LOGCXX-537) double mutex lock

2021-12-10 Thread Truman Lackey (Jira)
[ https://issues.apache.org/jira/browse/LOGCXX-537?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457393#comment-17457393 ] Truman Lackey commented on LOGCXX-537: -- I have create a github repo that with instructions and code

[GitHub] [logging-log4j2] philipwhiuk edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
philipwhiuk edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991305906 > https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/net/JMSAppender.html This presumably requires configuring the appending though, so a

[GitHub] [logging-log4j2] philipwhiuk edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
philipwhiuk edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991305906 > https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/net/JMSAppender.html This presumably requires configuring the appending though, so a

[GitHub] [logging-log4j2] vy commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
vy commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991306027 > I think [this fix may have been bypassed](https://twitter.com/stereotype32/status/1469313856229228544?s=20) and that the latest release is still vulnerable... Haven't

[GitHub] [logging-log4j2] philipwhiuk commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
philipwhiuk commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991305906 > https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/net/JMSAppender.html This presumably requires configuring the appending though, so a simple

[GitHub] [logging-log4j2] lawndoc edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
lawndoc edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991297822 I think [this fix may have been bypassed](https://twitter.com/stereotype32/status/1469313856229228544?s=20) and that the latest release is still vulnerable...

[GitHub] [logging-log4j2] lawndoc edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
lawndoc edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991297822 I think this [fix may have been bypassed](https://twitter.com/stereotype32/status/1469313856229228544?s=20) and that the latest release is still vulnerable...

[GitHub] [logging-log4j2] lawndoc commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
lawndoc commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991297822 I think this [fix has been bypassed](https://twitter.com/stereotype32/status/1469313856229228544?s=20) and that the latest release is still vulnerable... Haven't verified

[GitHub] [logging-log4j2] mosajjal commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
mosajjal commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991249117 Ah cool thanks for confirming. The tag in Github repo doesn't show that -- This is an automated message from the Apache Git Service. To respond to the message, please

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991248202 2.15.0 is already released. On Fri, Dec 10, 2021, 14:43 Ali Mosajjal ***@***.***> wrote: > Hi Team, > > I know a lot of local Maven package managers

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991247673 RC2 was promoted to 2.15.0 last night. It should already be mirrored to Maven Central. -- This is an automated message from the Apache Git Service. To respond to the

[GitHub] [logging-log4j2] mosajjal commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
mosajjal commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991246265 Hi Team, I know a lot of local Maven package managers don't pull the RC version of a release automatically (Nexus etc), is there a chance we can push RC2 to a

[GitHub] [logging-log4j2] vy commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
vy commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991241208 **For those who are looking for a JRE/JDK version to mitigate the problem**, please don't! CVE-2021-44228 creates a large attack surface depending on the imagination of the

[jira] [Updated] (LOG4J2-2721) Thread crash when parameter is a null value for StringMapMessage

2021-12-10 Thread Jira
[ https://issues.apache.org/jira/browse/LOG4J2-2721?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Rémi C. updated LOG4J2-2721: Fix Version/s: 3.0.0 > Thread crash when parameter is a null value for StringMapMessage >

[jira] [Commented] (LOG4J2-3198) Message lookups should be disabled by default

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3198?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457333#comment-17457333 ] Volkan Yazici commented on LOG4J2-3198: --- [~eever...@usgs.gov], yes, unfortunately the lookup is

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991233294 `JndiManager` is used by the other JNDI integration points. `JndiLookup` is what's exploitable in a log message, though if you're using JNDI in your configuration, a man in

[GitHub] [logging-log4j2] albertinix edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
albertinix edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991225381 (re: the fix for versions <= 2.14.1) Does anyone know if removing the `JndiLookup` class is enough? On the [Apache Log4j2

[GitHub] [logging-log4j2] albertinix commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
albertinix commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991225381 Does anyone know if removing the `JndiLookup` class is enough? On the [Apache Log4j2 page](https://logging.apache.org/log4j/2.x/) it's stated to: >Remove

[GitHub] [logging-log4j2] pjfanning commented on pull request #613: Spelling

2021-12-10 Thread GitBox
pjfanning commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991224174 One typo that I noticed earlier was 'primative' appearing in a few places in one of the PRs related to the recent CVE issue.

[GitHub] [logging-log4j2] TiloGit commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
TiloGit commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991215492 > > Can't find much info about it. > > grep-ing through the source code for jdk-11.0.1 we get `src/java.naming/com/sun/jndi/ldap/VersionHelper.java: PrivilegedAction

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991210213 > > @garydgregory is there a safe Java 11 version? > > Check the release notes for 11.0.1.

[jira] [Comment Edited] (LOG4J2-3198) Message lookups should be disabled by default

2021-12-10 Thread Eric Everman (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3198?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457298#comment-17457298 ] Eric Everman edited comment on LOG4J2-3198 at 12/10/21, 6:00 PM: - Is

[GitHub] [logging-log4j2] fxshlein commented on pull request #614: (doc) Fix environment variable for formatMsgNoLookups

2021-12-10 Thread GitBox
fxshlein commented on pull request #614: URL: https://github.com/apache/logging-log4j2/pull/614#issuecomment-991177316 I was going off this: https://logging.apache.org/log4j/2.x/manual/configuration.html Although its completely removed there now. This morning it was still there 

[jira] [Commented] (LOG4J2-3198) Message lookups should be disabled by default

2021-12-10 Thread Eric Everman (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3198?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457298#comment-17457298 ] Eric Everman commented on LOG4J2-3198: -- Is there any possible configuration where the text of

[GitHub] [logging-log4j2] jvz commented on pull request #613: Spelling

2021-12-10 Thread GitBox
jvz commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991165648 I'll review this in more detail later. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above

[GitHub] [logging-log4j2] jvz merged pull request #616: typo

2021-12-10 Thread GitBox
jvz merged pull request #616: URL: https://github.com/apache/logging-log4j2/pull/616 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] cheese1 opened a new pull request #616: typo

2021-12-10 Thread GitBox
cheese1 opened a new pull request #616: URL: https://github.com/apache/logging-log4j2/pull/616 the wepage should get updated, too. it seems that there is at least one typo already fixed but not deployed: https://logging.apache.org/log4j/2.x/manual/configuration.html#Architecture

[GitHub] [logging-log4j2] diegomrsantos removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
diegomrsantos removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991148664 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific

[GitHub] [logging-log4j2] diegomrsantos commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
diegomrsantos commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991148664 @peturthors I don't have much knowledge about this issue, so instead of guessing and grep-ing the source code, I was searching for official release notes. --

[GitHub] [logging-log4j2] peturthors commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
peturthors commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991139464 > Can't find much info about it. grep-ing through the source code for jdk-11.0.1 we get `src/java.naming/com/sun/jndi/ldap/VersionHelper.java:

[GitHub] [logging-log4j2] jsoref commented on a change in pull request #613: Spelling

2021-12-10 Thread GitBox
jsoref commented on a change in pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#discussion_r766802175 ## File path: log4j-core/src/test/java/org/apache/logging/log4j/core/time/internal/format/FastDateParserTest.java ## @@ -1,7 +1,7 @@ /* *

[GitHub] [logging-log4j2] jvz commented on pull request #613: Spelling

2021-12-10 Thread GitBox
jvz commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991107486 Josh, long time no see! It'd be awesome if you could either break up changes or leave PR comments on relevant areas to help with review. -- This is an automated message from

[GitHub] [logging-log4j2] vy merged pull request #614: (doc) Fix environment variable for formatMsgNoLookups

2021-12-10 Thread GitBox
vy merged pull request #614: URL: https://github.com/apache/logging-log4j2/pull/614 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[jira] [Commented] (LOG4J2-3203) Spelling

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457217#comment-17457217 ] Volkan Yazici commented on LOG4J2-3203: --- I am closing the issue due to the reasons I have

[jira] [Commented] (LOG4J2-3204) SpringLookup not found while Interpolator initializing

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3204?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457215#comment-17457215 ] Volkan Yazici commented on LOG4J2-3204: --- [~Francis_FY], mind submitting a fix for this

[GitHub] [logging-log4j2] vy commented on pull request #613: Spelling

2021-12-10 Thread GitBox
vy commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991069390 @jsoref, even though we appreciate your contribution for code clean-ups, it is quite time consuming for us to review every single line, in particular, given your changes span

[jira] [Commented] (LOG4J2-905) Ability to disable (date) lookup completely, compatibility issues with other libraries like Camel

2021-12-10 Thread Carter Kozak (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-905?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457201#comment-17457201 ] Carter Kozak commented on LOG4J2-905: - The global switch was added in 2017 via

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991050192 > @garydgregory is there a safe Java 11 version? Check the release notes for 11.0.1. -- This is an automated message from the Apache Git Service. To respond

[jira] [Commented] (LOG4J2-3206) 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3206?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457198#comment-17457198 ] Volkan Yazici commented on LOG4J2-3206: --- [~zhengqin], mind updating the ticket title & description

[GitHub] [logging-log4j2] diegomrsantos commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
diegomrsantos commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991046595 @garydgregory is there a safe Java 11 version? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and

[jira] [Commented] (LOG4J2-905) Ability to disable (date) lookup completely, compatibility issues with other libraries like Camel

2021-12-10 Thread Jira
[ https://issues.apache.org/jira/browse/LOG4J2-905?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457193#comment-17457193 ] moritz löser commented on LOG4J2-905: - and now we

[GitHub] [logging-log4j2] iidx opened a new pull request #615: (doc) lookups.adoc - Spelling mistake

2021-12-10 Thread GitBox
iidx opened a new pull request #615: URL: https://github.com/apache/logging-log4j2/pull/615 Noticed a spelling mistake in lookups.adoc. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the

[jira] [Commented] (LOG4J2-3205) OutputStreamManager.flushBuffer throw NoSuchMethodError ByteBuffer.clear

2021-12-10 Thread dingjsh (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3205?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457152#comment-17457152 ] dingjsh commented on LOG4J2-3205: - Thank you for your reply. But is it my method would be better. In

[jira] [Updated] (LOG4J2-3206) 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步

2021-12-10 Thread zheng qin (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3206?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] zheng qin updated LOG4J2-3206: -- Description: 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步,希望尽快同步到github (was:

[jira] [Created] (LOG4J2-3206) 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步

2021-12-10 Thread zheng qin (Jira)
zheng qin created LOG4J2-3206: - Summary: 官网已发布Log4j2远程代码执行紧急漏洞修复版本2.15.0,但github尚未同步 Key: LOG4J2-3206 URL: https://issues.apache.org/jira/browse/LOG4J2-3206 Project: Log4j 2 Issue Type: Wish

[jira] [Commented] (LOG4J2-3205) OutputStreamManager.flushBuffer throw NoSuchMethodError ByteBuffer.clear

2021-12-10 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3205?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17457136#comment-17457136 ] Gary D. Gregory commented on LOG4J2-3205: - You MUST use Java 8 to target Java 8 in this case

[GitHub] [logging-log4j2] fxshlein opened a new pull request #614: (doc) Fix environment variable for formatMsgNoLookups

2021-12-10 Thread GitBox
fxshlein opened a new pull request #614: URL: https://github.com/apache/logging-log4j2/pull/614 The documentation currently says `FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS` is the correct environment variable to disable the message pattern lookups, however after testing, it seems that

[jira] [Created] (LOG4J2-3205) OutputStreamManager.flushBuffer throw NoSuchMethodError ByteBuffer.clear

2021-12-10 Thread dingjsh (Jira)
dingjsh created LOG4J2-3205: --- Summary: OutputStreamManager.flushBuffer throw NoSuchMethodError ByteBuffer.clear Key: LOG4J2-3205 URL: https://issues.apache.org/jira/browse/LOG4J2-3205 Project: Log4j 2

[GitHub] [logging-log4j2] Baoqi removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Baoqi removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990861408 > @Baoqi so this CVE impact log4j v 1.xx only if app is using JMSAddapter in log4j configuration(log4j.properties) or not? @sysmat I don't have answer for

[GitHub] [logging-log4j2] zutnop edited a comment on pull request #308: LOG4J2-1192 (support dynamic Subject)

2021-12-10 Thread GitBox
zutnop edited a comment on pull request #308: URL: https://github.com/apache/logging-log4j2/pull/308#issuecomment-990897937 It's a loss, that this wasn't merged into the project. I have been using it (for solving the related issue with dynamic subjects) for over 4 years in production with

[GitHub] [logging-log4j2] zutnop commented on pull request #308: LOG4J2-1192 (support dynamic Subject)

2021-12-10 Thread GitBox
zutnop commented on pull request #308: URL: https://github.com/apache/logging-log4j2/pull/308#issuecomment-990897937 It's a loss, that this wasn't merged into the project. I have been using it (for solving the related issue with dynamic subjects) for over 4 years in production with

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990885523 Yes, Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990881498 > > Hi there. Would setting the JVM property `com.sun.jndi.ldap.object.trustURLCodebase = false` mitigate this ? Thanks. > > It is false by default. > >

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990880189 > Hi there. Would setting the JVM property `com.sun.jndi.ldap.object.trustURLCodebase = false` mitigate this ? Thanks. It is false by default. Java 8u121

[GitHub] [logging-log4j2] peturthors commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
peturthors commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990879257 Hi there. Would setting the JVM property `com.sun.jndi.ldap.object.trustURLCodebase = false` mitigate this ? Thanks. -- This is an automated message from the

[GitHub] [logging-log4j2] ryancastle commented on a change in pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
ryancastle commented on a change in pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#discussion_r766585720 ## File path: log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/JmsAppender.java ## @@ -100,8 +109,21 @@ public JmsAppender

[GitHub] [logging-log4j2] Rongmario commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Rongmario commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990864435 https://github.com/LoliKingdom/NukeJndiLookupFromLog4j is nearly live on CurseForge (modding platform for Minecraft), it'll target any clients/servers running with

[GitHub] [logging-log4j2] Baoqi commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
Baoqi commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990861408 > @Baoqi so this CVE impact log4j v 1.xx only if app is using JMSAddapter in log4j configuration(log4j.properties) or not? @sysmat I don't have answer for this, as

[GitHub] [logging-log4j2] sysmat edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
sysmat edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990814971 @Baoqi so this CVE impact log4j v 1.xx only if app is using JMSAddapter in log4j configuration(log4j.properties) or not? -- This is an automated message from the

[GitHub] [logging-log4j2] sysmat commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
sysmat commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990814971 @Baoqi so this CVE impact log4j v 1.xx only if app is using JMSAddapter or not? -- This is an automated message from the Apache Git Service. To respond to the message,

[GitHub] [logging-log4j2] iamamoose commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
iamamoose commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990788953 https://www.cve.org/CVERecord?id=CVE-2021-44228 https://logging.apache.org/log4j/2.x/security.html -- This is an automated message from the Apache Git Service. To

[GitHub] [logging-log4j2] mageshwarang edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
mageshwarang edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990765517 @remkop Thanks for clarifying on the log4j 1.x. One of my old application is still using `log4j-1.2.17` and few of my applications are using

[GitHub] [logging-log4j2] mageshwarang commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
mageshwarang commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990765517 @remkop Thanks for clarifying on the log4j 1.x. One of my old application is still using `log4j-1.2.17` and few of my applications are using `log4j-over-slf4j`. But

[GitHub] [logging-log4j2] utam0k edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
utam0k edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990716441 @remkop Hi! Thanks for your work and the community correspondence. Do you have any plans to backport the correspondence to this vulnerability to older versions of

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990758663 > @remkop , thanks for your reply. Just want to make it more clear, because many people reach this issue mainly for the "JNDI lookup" CVE, so, for log4j 1.x, although it

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990753698 > I saw 2.15.0 was uploaded to the maven central: > > https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-api/2.15.0/ > > Could anyone point

[jira] [Commented] (LOG4J2-3201) Limit the protocols jNDI can use and restrict LDAP.

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3201?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17456962#comment-17456962 ] Volkan Yazici commented on LOG4J2-3201: --- [~pingqicao], if you only depend on {{log4j-api}}, you

[jira] [Commented] (LOG4J2-3201) Limit the protocols jNDI can use and restrict LDAP.

2021-12-10 Thread pingqicao (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3201?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17456958#comment-17456958 ] pingqicao commented on LOG4J2-3201: --- my project do not depends on log4j-core, but depends on

[GitHub] [logging-log4j2] iweiss commented on a change in pull request #608: Restrict LDAP access via JNDI

2021-12-10 Thread GitBox
iweiss commented on a change in pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#discussion_r766474285 ## File path: src/site/xdoc/manual/appenders.xml ## @@ -1555,6 +1555,33 @@ public class ConnectionFactory { Default

[jira] [Commented] (LOG4J2-3201) Limit the protocols jNDI can use and restrict LDAP.

2021-12-10 Thread Volkan Yazici (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3201?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17456954#comment-17456954 ] Volkan Yazici commented on LOG4J2-3201: --- [~e1knot], for the records, you can _"fix"_ the problem

[GitHub] [logging-log4j2] vy commented on pull request #538: Resolve references inside javadoc.

2021-12-10 Thread GitBox
vy commented on pull request #538: URL: https://github.com/apache/logging-log4j2/pull/538#issuecomment-990728731 We have shared with @arturobernalg in the dev mailing list that we are understaffed to deal with the cosmetic changes he has proposed so far, hence closing the ticket. --

[GitHub] [logging-log4j2] vy commented on pull request #535: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy commented on pull request #535: URL: https://github.com/apache/logging-log4j2/pull/535#issuecomment-990728405 We have shared with @arturobernalg in the dev mailing list that we are understaffed to deal with the cosmetic changes he has proposed so far, hence closing the ticket. --

[GitHub] [logging-log4j2] vy commented on pull request #536: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy commented on pull request #536: URL: https://github.com/apache/logging-log4j2/pull/536#issuecomment-990728479 We have shared with @arturobernalg in the dev mailing list that we are understaffed to deal with the cosmetic changes he has proposed so far, hence closing the ticket. --

[GitHub] [logging-log4j2] vy closed pull request #536: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy closed pull request #536: URL: https://github.com/apache/logging-log4j2/pull/536 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] vy closed pull request #535: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy closed pull request #535: URL: https://github.com/apache/logging-log4j2/pull/535 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] vy commented on pull request #534: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy commented on pull request #534: URL: https://github.com/apache/logging-log4j2/pull/534#issuecomment-990728326 We have shared with @arturobernalg in the dev mailing list that we are understaffed to deal with the cosmetic changes he has proposed so far, hence closing the ticket. --

[GitHub] [logging-log4j2] vy closed pull request #534: Make Local variable and parameter final.

2021-12-10 Thread GitBox
vy closed pull request #534: URL: https://github.com/apache/logging-log4j2/pull/534 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] vy closed pull request #530: Remove unused import.

2021-12-10 Thread GitBox
vy closed pull request #530: URL: https://github.com/apache/logging-log4j2/pull/530 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] vy closed pull request #532: Replace loop with bulk method.

2021-12-10 Thread GitBox
vy closed pull request #532: URL: https://github.com/apache/logging-log4j2/pull/532 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

  1   2   >