[GitHub] [solr-site] thelabdude commented on a change in pull request #52: More details on log4j 1.2

[GitBox <gi...@apache.org>]

thelabdude commented on a change in pull request #52:
URL: https://github.com/apache/solr-site/pull/52#discussion_r767063125



##########
File path: content/solr/security/2021-12-10-cve-2021-44228.md
##########
@@ -11,7 +11,7 @@ Critical
 **Description:**
 Apache Solr releases prior to 8.11.1 were using a bundled version of the Apache Log4J library vulnerable to RCE. For full impact and additional detail consult the Log4J security page.
 
-Apache Solr releases prior to 7.0 (i.e. all Solr 5 and Solr 6 releases) use log4j 1.2.17 which may be vulnerable for installations using non-default logging configurations. To determine you if you are vulnerable please consult the Log4J security page.
+Apache Solr releases prior to 7.4 (i.e. Solr 5, Solr 6, and Solr 7 through 7.3) use log4j 1.2.17 which may be vulnerable for installations using non-default logging configurations that include the JMS Appender, see https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 for discussion.

Review comment:
       done: https://github.com/apache/solr-site/commit/7eba60ca07f0215b2f616513cbf0756ee715dd18




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org