You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by rp...@apache.org on 2021/12/17 05:23:51 UTC
[logging-log4j-site] branch asf-staging updated: CVE-2021-45046 severity critical (additional minor fixes 5)
This is an automated email from the ASF dual-hosted git repository.
rpopma pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/logging-log4j-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 53e8e6b CVE-2021-45046 severity critical (additional minor fixes 5)
53e8e6b is described below
commit 53e8e6b50745dea5f0137cd1c0c393e293e25e83
Author: Remko Popma <re...@yahoo.com>
AuthorDate: Fri Dec 17 14:23:45 2021 +0900
CVE-2021-45046 severity critical (additional minor fixes 5)
---
log4j-2.16.0/security.html | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/log4j-2.16.0/security.html b/log4j-2.16.0/security.html
index 79932eb..a54b853 100644
--- a/log4j-2.16.0/security.html
+++ b/log4j-2.16.0/security.html
@@ -217,7 +217,7 @@
<p>The safest thing to do is to upgrade Log4j to a safe version, or remove the JndiLookup class from the log4j-core jar.</p></section><section>
<h3><a name="Release_Details"></a>Release Details</h3>
<p>From version 2.16.0 (for Java 8), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. Users are advised not to enable JNDI in Log4j 2.16.0. If the JMS Appender is required, use Log4j 2.12.2.</p>
- <p>From version 2.12.2 (for Java 7), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. When enabled, JNDI will only support the java protocol. Hosts other than the local host need to be explicitly allowed.</p></section><section>
+ <p>From version 2.12.2 (for Java 7), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. When enabled, JNDI will only support the java protocol.</p></section><section>
<h3><a name="Work_in_progress"></a>Work in progress</h3>
<p>The Log4j team will continue to actively update this page as more information becomes known.</p></section><section>
<h3><a name="Credit"></a>Credit</h3>
@@ -277,7 +277,7 @@
<h4><a name="Release_Details"></a>Release Details</h4>
<p>As of Log4j 2.15.0 the message lookups feature was disabled by default. Lookups in configuration still work. While Log4j 2.15.0 has an option to enable Lookups in this fashion, users are strongly discouraged from enabling it. A whitelisting mechanism was introduced for JNDI connections, allowing only localhost by default. The 2.15.0 release was found to have additional vulnerabilities and is not recommended.</p>
<p>From version 2.16.0 (for Java 8), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. Users are advised not to enable JNDI in Log4j 2.16.0. If the JMS Appender is required, use Log4j 2.12.2.</p>
- <p>From version 2.12.2 (for Java 7), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. When enabled, JNDI will only support the java protocol. Hosts other than the local host need to be explicitly allowed.</p></section></section><section>
+ <p>From version 2.12.2 (for Java 7), the message lookups feature has been completely removed. Lookups in configuration still work. Furthermore, Log4j now disables access to JNDI by default. JNDI lookups in configuration now need to be enabled explicitly. When enabled, JNDI will only support the java protocol.</p></section></section><section>
<h3><a name="Work_in_progress"></a>Work in progress</h3>
<p>The Log4j team will continue to actively update this page as more information becomes known.</p></section><section>
<h3><a name="Credit"></a>Credit</h3>