[GitHub] [logging-log4cxx] ams-tschoening merged pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
ams-tschoening merged pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4cxx] ams-tschoening commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
ams-tschoening commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770285461 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4j2] EmYiQing removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995498548 @remkop Friends, For more analysis on denial of service vulnerabilities, please refer to my article: https://xz.aliyun.com/t/10670 (If you can't

[jira] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread 4ra1n (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221 ] 4ra1n deleted comment on LOG4J2-3221: --- was (Author: JIRAUSER281614): Friends, For more analysis on denial of service vulnerabilities, please refer to my article: [https://xz.aliyun.com/t/10670]

[jira] [Commented] (LOG4J2-3242) Limit JNDI to the java protocol only

2021-12-15 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3242?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460449#comment-17460449 ] ASF subversion and git services commented on LOG4J2-3242: - Commit

[jira] [Created] (LOG4J2-3242) Limit JNDI to the java protocol only

2021-12-15 Thread Ralph Goers (Jira)
Ralph Goers created LOG4J2-3242: --- Summary: Limit JNDI to the java protocol only Key: LOG4J2-3242 URL: https://issues.apache.org/jira/browse/LOG4J2-3242 Project: Log4j 2 Issue Type: Bug

[jira] [Assigned] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-15 Thread Ralph Goers (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Ralph Goers reassigned LOG4J2-3230: --- Assignee: Carter Kozak > Certain strings can cause infinite recursion >

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread 4ra1n (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460442#comment-17460442 ] 4ra1n commented on LOG4J2-3221: --- Friends, For more analysis on denial of service vulnerabilities, please

[GitHub] [logging-log4j2] EmYiQing commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995498548 @remkop Friends, For more analysis on denial of service vulnerabilities, please refer to my article: https://xz.aliyun.com/t/10670 (If you can't understand the

[GitHub] [logging-log4net] fluffynuts merged pull request #79: (LOG4NET-671) Dispose WindowsIdentity in TryGetCurrentUserName()

2021-12-15 Thread GitBox
fluffynuts merged pull request #79: URL: https://github.com/apache/logging-log4net/pull/79 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] quaff edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
quaff edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995493864 @remkop Description of `CVE-2021-45046` is not accurate, could you verify and update security page? > Thread Context Map pattern (%X, %mdc, or %MDC) I can

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995496519 @quaff Good point yes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the

[jira] [Work logged] (LOG4NET-680) .NET 6 threadpool thread name is not helpful in %thread/%t field

2021-12-15 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/LOG4NET-680?focusedWorklogId=697103=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-697103 ] ASF GitHub Bot logged work on LOG4NET-680: -- Author: ASF GitHub Bot

[jira] [Work logged] (LOG4NET-671) LoggingEvent does not correctly dispose WindowsIdentity

2021-12-15 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/LOG4NET-671?focusedWorklogId=697104=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-697104 ] ASF GitHub Bot logged work on LOG4NET-671: -- Author: ASF GitHub Bot

[GitHub] [logging-log4net] fluffynuts merged pull request #78: (LOG4NET-680) For %thread/%t, use the numeric thread ID for .NET worker pool threads

2021-12-15 Thread GitBox
fluffynuts merged pull request #78: URL: https://github.com/apache/logging-log4net/pull/78 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4j2] quaff commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
quaff commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995493864 @remkop Description of `CVE-2021-45046` is not accurate, could you verify and update security page? > Thread Context Map pattern (%X, %mdc, or %MDC) I can confirm

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770247583 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770247583 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770247583 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770247583 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770247583 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4j2] ichux commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-15 Thread GitBox
ichux commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r770242666 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2 -

[GitHub] [logging-log4j2] ichux commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-15 Thread GitBox
ichux commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r770242666 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2 -

[GitHub] [logging-log4j2] ichux commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-15 Thread GitBox
ichux commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r770242666 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2 -

[jira] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread 4ra1n (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221 ] 4ra1n deleted comment on LOG4J2-3221: --- was (Author: JIRAUSER281614): I reported this problem to the logging PMC last week. Although I didn't propose threadcontext, I also explained the trigger

[GitHub] [logging-log4j-site] remkop edited a comment on pull request #4: Yet more 2.3 fixes

2021-12-15 Thread GitBox
remkop edited a comment on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995432928 FYI The 2.12.2 site that @garydgregory created has been merged and is now live. The 2.12.1 site is no longer referenced from the main web site

[GitHub] [logging-log4j-site] remkop commented on pull request #4: Yet more 2.3 fixes

2021-12-15 Thread GitBox
remkop commented on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995432928 FYI The site that @garydgregory created has been merged and is now live. The 2.12.1 site is no longer referenced from the main web site

[GitHub] [logging-log4j2] EmYiQing commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995429097 @remkop Thank you very much for your work -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995427431 > > @remkop Thank you for your reply I sent a vulnerability report to [priv...@logging.apache.org](mailto:priv...@logging.apache.org) on December 10 and received a

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995427431 > > @remkop Thank you for your reply I sent a vulnerability report to [priv...@logging.apache.org](mailto:priv...@logging.apache.org) on December 10 and received a

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995427431 > > @remkop Thank you for your reply I sent a vulnerability report to [priv...@logging.apache.org](mailto:priv...@logging.apache.org) on December 10 and received a reply

[jira] [Commented] (LOG4J2-3220) CVE-2021-44228

2021-12-15 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3220?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460372#comment-17460372 ] ASF subversion and git services commented on LOG4J2-3220: - Commit

[jira] [Comment Edited] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Yanming Zhou (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460359#comment-17460359 ] Yanming Zhou edited comment on LOG4J2-3221 at 12/16/21, 2:23 AM: - My

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Yanming Zhou (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460359#comment-17460359 ] Yanming Zhou commented on LOG4J2-3221: -- My tests show that %X{} %mdc{} %MDC{} are not affected,

[GitHub] [logging-log4j-site] garydgregory edited a comment on pull request #4: Yet more 2.3 fixes

2021-12-15 Thread GitBox
garydgregory edited a comment on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995321695 Hi All, I think we are going to regenerate the whole 2.12.1 site soon in order to get back to where we started. I just pushed a site for 2.12.2. Now I am

[GitHub] [logging-log4j-site] garydgregory commented on pull request #4: Yet more 2.3 fixes

2021-12-15 Thread GitBox
garydgregory commented on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995321695 Hi All, I think we are going to regenerate the whole 2.12.1 site soon in order to get back to where we started. I just pushed a site for 2.12.2. Now I am looking

[jira] [Commented] (LOG4J2-3220) CVE-2021-44228

2021-12-15 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3220?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460334#comment-17460334 ] ASF subversion and git services commented on LOG4J2-3220: - Commit

[GitHub] [logging-log4j-site] sebbASF opened a new pull request #4: Yet more 2.3 fixes

2021-12-15 Thread GitBox
sebbASF opened a new pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4 Sorry, I missed some of the 2.3 files. Hopefully this is the last of them -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and

[GitHub] [logging-log4j-site] rgoers commented on pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
rgoers commented on pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2#issuecomment-995283886 Thanks Sebb. We appreciate the help. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above

[GitHub] [logging-log4j-site] rgoers merged pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
rgoers merged pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[jira] [Closed] (LOG4J2-3222) Documentation at https://logging.apache.org/log4j/2.x/ has obsolete references to 2.15.1

2021-12-15 Thread Remko Popma (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3222?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Remko Popma closed LOG4J2-3222. --- Closing. Confirmed as fixed. > Documentation at https://logging.apache.org/log4j/2.x/ has obsolete >

[GitHub] [logging-log4j-site] sebbASF commented on pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
sebbASF commented on pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2#issuecomment-995281871 At least I intended to do so; looks like the same branch was updated twice -- This is an automated message from the Apache Git Service. To respond to the message, please

[GitHub] [logging-log4j-site] rgoers commented on pull request #3: Fix links for 2.3

2021-12-15 Thread GitBox
rgoers commented on pull request #3: URL: https://github.com/apache/logging-log4j-site/pull/3#issuecomment-995281273 Can you change this to apply to asf-staging first? We always commit there and then merge or rebase to asf-site from asf-staging. -- This is an automated message from the

[GitHub] [logging-log4j-site] sebbASF commented on pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
sebbASF commented on pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2#issuecomment-995281044 I did the same change to both files; take your pick -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and

[GitHub] [logging-log4j2] EmYiQing edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-994307693 I reported this denial of Service Vulnerability (cve-2021-45046) to the logging PMC last week. I proposed the core code and trigger method of denial of service

[GitHub] [logging-log4j-site] rgoers edited a comment on pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
rgoers edited a comment on pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2#issuecomment-995278148 Was this done to asf-staging first? We always commit there and then merge or rebase to asf-site from asf-staging. -- This is an automated message from the

[GitHub] [logging-log4j-site] rgoers commented on pull request #2: Fix links for release 2.3

2021-12-15 Thread GitBox
rgoers commented on pull request #2: URL: https://github.com/apache/logging-log4j-site/pull/2#issuecomment-995278148 Was this done to asf-staging first? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above

[GitHub] [logging-log4j2] EmYiQing edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995268775 @mrdgsmith Here I discuss the denial of Service Vulnerability **CVE-2021-45046** rather than the JNDI injection Vulnerability **CVE-2021-44228** -- This is an

[jira] [Commented] (LOG4J2-3241) log4j-api-java9.pom and log4j-core-java9.pom sometimes cause maven enforcer to fail

2021-12-15 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3241?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460311#comment-17460311 ] ASF subversion and git services commented on LOG4J2-3241: - Commit

[GitHub] [logging-log4j2] EmYiQing commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
EmYiQing commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995268775 @mrdgsmith Here I discuss the denial of Service Vulnerability **CVE-2021-45046** rather than the Remote Code Execution Vulnerability **CVE-2021-44228** -- This is an

[jira] [Created] (LOG4J2-3241) log4j-api-java9.pom and log4j-core-java9.pom sometimes cause maven enforcer to fail

2021-12-15 Thread Ralph Goers (Jira)
Ralph Goers created LOG4J2-3241: --- Summary: log4j-api-java9.pom and log4j-core-java9.pom sometimes cause maven enforcer to fail Key: LOG4J2-3241 URL: https://issues.apache.org/jira/browse/LOG4J2-3241

[jira] [Closed] (LOG4J2-3240) org.apache.logging.log4 does not match archive.apache.org/dist/logging/log4j/

2021-12-15 Thread Kevin Kotas (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3240?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Kevin Kotas closed LOG4J2-3240. --- Resolution: Duplicate  https://issues.apache.org/jira/browse/LOG4J2-3239  >

[jira] [Created] (LOG4J2-3240) org.apache.logging.log4 does not match archive.apache.org/dist/logging/log4j/

2021-12-15 Thread Kevin Kotas (Jira)
Kevin Kotas created LOG4J2-3240: --- Summary: org.apache.logging.log4 does not match archive.apache.org/dist/logging/log4j/ Key: LOG4J2-3240 URL: https://issues.apache.org/jira/browse/LOG4J2-3240 Project:

[jira] [Commented] (LOG4J2-3239) Log4j-core-2.16.0.jar has a different MD5 in Maven Central!

2021-12-15 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3239?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460279#comment-17460279 ] Matt Sicker commented on LOG4J2-3239: - Sounds like the bnd plugin is responsible for this manifest

[jira] [Resolved] (LOG4J2-1947) using mvn install to the project log4j2 causes build failure.

2021-12-15 Thread Ralph Goers (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-1947?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Ralph Goers resolved LOG4J2-1947. - Resolution: Abandoned > using mvn install to the project log4j2 causes build failure. >

[jira] [Commented] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460274#comment-17460274 ] Gary D. Gregory commented on LOG4J2-3234: - [~jakedern-msft]  You're welcome, I am glad you

[jira] [Created] (LOG4J2-3239) Log4j-core-2.16.0.jar has a different MD5 in Maven Central!

2021-12-15 Thread Kami Shishegar (Jira)
Kami Shishegar created LOG4J2-3239: -- Summary: Log4j-core-2.16.0.jar has a different MD5 in Maven Central! Key: LOG4J2-3239 URL: https://issues.apache.org/jira/browse/LOG4J2-3239 Project: Log4j 2

[jira] [Updated] (LOG4J2-3238) Log4j 1.2 bridge API doesn't write the messages to rsyslog in proper "PatternLayout" mentioned in log4j.properties file when SysLogAppender is used

2021-12-15 Thread Tukesh (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3238?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Tukesh updated LOG4J2-3238: --- Environment: *JDK .1.8 :-* copy-jdk-configs-3.3-10.el7_5.noarch

[jira] [Updated] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514

2021-12-15 Thread Tukesh (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Tukesh updated LOG4J2-3237: --- Description: *Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514*

[jira] [Updated] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514

2021-12-15 Thread Tukesh (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Tukesh updated LOG4J2-3237: --- Description: *Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514*

[jira] [Created] (LOG4J2-3238) Log4j 1.2 bridge API doesn't write the messages to rsyslog in proper "PatternLayout" mentioned in log4j.properties file when SysLogAppender is used

2021-12-15 Thread Tukesh (Jira)
Tukesh created LOG4J2-3238: -- Summary: Log4j 1.2 bridge API doesn't write the messages to rsyslog in proper "PatternLayout" mentioned in log4j.properties file when SysLogAppender is used Key: LOG4J2-3238 URL:

[jira] [Created] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514

2021-12-15 Thread Tukesh (Jira)
Tukesh created LOG4J2-3237: -- Summary: Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514 Key: LOG4J2-3237 URL: https://issues.apache.org/jira/browse/LOG4J2-3237

[jira] [Closed] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Jake Dern (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Jake Dern closed LOG4J2-3234. - Resolution: Invalid Issue is not with log4jv2, but rather was a build error. > NoClassDefFoundError:

[jira] [Commented] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Jake Dern (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460198#comment-17460198 ] Jake Dern commented on LOG4J2-3234: --- [~ggregory] You were correct - After digging through our build

[jira] [Commented] (LOG4J2-3222) Documentation at https://logging.apache.org/log4j/2.x/ has obsolete references to 2.15.1

2021-12-15 Thread Daniel Kirkdorffer (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3222?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460194#comment-17460194 ] Daniel Kirkdorffer commented on LOG4J2-3222: [~rpopma] Yes, it is updated now, but it wasn't

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Thomas Broyer (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460182#comment-17460182 ] Thomas Broyer commented on LOG4J2-3221: --- [~OmarKhaleel] From the advisory

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Omar Khaleel (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460160#comment-17460160 ] Omar Khaleel commented on LOG4J2-3221: -- Hello Dears, can anyone answer my following two questions?

[GitHub] [logging-log4j2] mrdgsmith edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
mrdgsmith edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995025131 > @remkop Thank you for your reply I sent a vulnerability report to [priv...@logging.apache.org](mailto:priv...@logging.apache.org) on December 10 and received a

[jira] [Comment Edited] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460143#comment-17460143 ] Gary D. Gregory edited comment on LOG4J2-3234 at 12/15/21, 5:58 PM:

[jira] [Comment Edited] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460143#comment-17460143 ] Gary D. Gregory edited comment on LOG4J2-3234 at 12/15/21, 5:58 PM:

[jira] [Commented] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460143#comment-17460143 ] Gary D. Gregory commented on LOG4J2-3234: - [~jakedern-msft]  If you open the jar file in a Zip

[GitHub] [logging-log4j2] mrdgsmith commented on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
mrdgsmith commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-995025131 > @remkop Thank you for your reply I sent a vulnerability report to [priv...@logging.apache.org](mailto:priv...@logging.apache.org) on December 10 and received a reply

[jira] [Commented] (LOG4J2-3234) NoClassDefFoundError: org/apache/logging/log4j/core/lookup/JndiLookup when upgrading to 2.16.0

2021-12-15 Thread Jake Dern (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460132#comment-17460132 ] Jake Dern commented on LOG4J2-3234: --- [~ggregory]  Thanks for the suggestion. I went back and

[GitHub] [logging-log4cxx] ams-tschoening commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-15 Thread GitBox
ams-tschoening commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r769845917 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[jira] [Comment Edited] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3236?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460079#comment-17460079 ] Chris Hegarty edited comment on LOG4J2-3236 at 12/15/21, 5:03 PM: --

[jira] [Updated] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Chris Hegarty updated LOG4J2-3236: -- Description: During upgrade of log4j in Elasticsearch [1] (from 2.11.1 to 2.15+) it has been

[jira] [Comment Edited] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3236?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460079#comment-17460079 ] Chris Hegarty edited comment on LOG4J2-3236 at 12/15/21, 4:41 PM: --

[jira] [Commented] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3236?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460079#comment-17460079 ] Chris Hegarty commented on LOG4J2-3236: --- Additionally, or alternatively, log4j could decided to

[jira] [Updated] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Chris Hegarty updated LOG4J2-3236: -- Description: During upgrade of log4j in Elasticsearch [1] (from 2.11.1 to 2.15+) it has been

[GitHub] [logging-log4cxx] fulldecent edited a comment on pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
fulldecent edited a comment on pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84#issuecomment-994936491 Thank you. Sorry for my confusion here. Yes, I see that Log4cxx is NOT an implementation of Log4j2. This issue applies only to Log4j2 implementations

[GitHub] [logging-log4cxx] fulldecent commented on pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
fulldecent commented on pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84#issuecomment-994936491 Thank you. Sorry for my confusion here. Yes, I see that Log4cxx is NOT an implementation of Log4j2. They are different things. The only thing the same is the

[jira] [Created] (LOG4J2-3236) Improve privileged access to parent class loader in LoaderUtil

2021-12-15 Thread Chris Hegarty (Jira)
Chris Hegarty created LOG4J2-3236: - Summary: Improve privileged access to parent class loader in LoaderUtil Key: LOG4J2-3236 URL: https://issues.apache.org/jira/browse/LOG4J2-3236 Project: Log4j 2

[GitHub] [logging-log4cxx] ams-tschoening commented on pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
ams-tschoening commented on pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84#issuecomment-994927090 > This issue discussed here affects:[...] Log4cxx is neither API compatible with Log4j2 nor an implementation of that. AFAIK Log4cxx doesn't even claim to be

[GitHub] [logging-log4cxx] rm5248 closed pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
rm5248 closed pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

[GitHub] [logging-log4cxx] rm5248 commented on pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
rm5248 commented on pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84#issuecomment-994925954 You're confusing two projects here. Log4j2 is a logging implementation for Java. Log4cxx is a logging implementation for C++. It is largely based off of

[GitHub] [logging-log4j2] fulldecent opened a new pull request #630: Log4j2 is still vulnerable and underspecified. This updates documenta…

2021-12-15 Thread GitBox
fulldecent opened a new pull request #630: URL: https://github.com/apache/logging-log4j2/pull/630 # Summary The log4j2 API is underspecified and still vulnerable to undefined behavior. Affects all versions up to and including the current 2.16.0. This quick PR fixes the

[GitHub] [logging-log4j2] zhangyoufu edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-15 Thread GitBox
zhangyoufu edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990305306 You can't ask everybody to upgrade to 2.15 at once. And the `formatMsgNoLookups` option is available to log4j ≥ 2.10 only. Thanks to

[jira] [Comment Edited] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459976#comment-17459976 ] Simon Ziller edited comment on LOG4J2-3192 at 12/15/21, 3:08 PM: - I've

[jira] [Comment Edited] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459976#comment-17459976 ] Simon Ziller edited comment on LOG4J2-3192 at 12/15/21, 3:08 PM: - I've

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Thomas Broyer (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17460029#comment-17460029 ] Thomas Broyer commented on LOG4J2-3221: --- As the attack vector here is mostly ThreadContext, would

[GitHub] [logging-log4cxx] fulldecent commented on pull request #84: Fix underspecification for logger

2021-12-15 Thread GitBox
fulldecent commented on pull request #84: URL: https://github.com/apache/logging-log4cxx/pull/84#issuecomment-994867538 Coming back here with more time to type. This issue discussed here affects: - The Apache Log4j 2 API specification - Every Apache Log4j 2 implementation

[jira] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192 ] Simon Ziller deleted comment on LOG4J2-3192: -- was (Author: JIRAUSER280386): I've created a small tool "Log4j2Test.zip", including all libraries we use for our application including sub

[jira] [Reopened] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Ziller reopened LOG4J2-3192: -- I've created a small tool "Log4j2Test.zip", including all libraries we use for our application

[jira] [Commented] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459973#comment-17459973 ] Simon Ziller commented on LOG4J2-3192: -- I've created a small tool "Log4j2Test.zip", including all

[jira] [Updated] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-15 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Ziller updated LOG4J2-3192: - Attachment: Log4j2Test.zip > log4j2.properties: monitorInterval has no effect since 2.13.2 >

[jira] [Commented] (LOG4J2-3231) JndiManager.isJndiEnabled generates a call to NetUtils.getLocalIps

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459942#comment-17459942 ] Gary D. Gregory commented on LOG4J2-3231: - And why can't I edit my own comments in Jira? >

[jira] [Commented] (LOG4J2-3231) JndiManager.isJndiEnabled generates a call to NetUtils.getLocalIps

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459941#comment-17459941 ] Gary D. Gregory commented on LOG4J2-3231: - Hi [~rgoers]  Take care of it how? This is caused by

[jira] [Commented] (LOG4J2-3235) Exception: Invalid byte tag in constant pool: 19 for module-info.class Java 7

2021-12-15 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459915#comment-17459915 ] Gary D. Gregory commented on LOG4J2-3235: - It looks to me like there are two issues here: * I

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-15 Thread Remko Popma (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459888#comment-17459888 ] Remko Popma commented on LOG4J2-3221: - [Looks

[jira] [Commented] (LOG4J2-3235) Exception: Invalid byte tag in constant pool: 19 for module-info.class Java 7

2021-12-15 Thread Saptarshi De (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17459870#comment-17459870 ] Saptarshi De commented on LOG4J2-3235: -- Well I cannot update BCEL as I don't directly control the

  1   2   >