[GitHub] [trafficcontrol] rawlinp commented on issue #5782: There is a vulnerability in log4j 1.2.17 ,upgrade recommended

[GitBox <gi...@apache.org>]

rawlinp commented on issue #5782:
URL: https://github.com/apache/trafficcontrol/issues/5782#issuecomment-827752047


   > Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
   
   We do not use the SMTP appender.
   
   > Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
   
   TR doesn't use a deserialization gadget or listen to untrusted network traffic for log data.
   
   Therefore, I don't believe we're vulnerable to these CVEs, but we should probably upgrade these dependencies when we get the chance.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org