You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@helix.apache.org by GitBox <gi...@apache.org> on 2021/12/15 05:39:56 UTC
[GitHub] [helix] brentwritescode opened a new issue #1921: Consider upgrading Log4J to version 2.16.x from Log4J 1.x to avoid known vulnerabilities
brentwritescode opened a new issue #1921:
URL: https://github.com/apache/helix/issues/1921
The past week has demonstrated some particularly problematic bugs with the Log4J project. While the most pressing vulnerability is with Log4j 2.x (2.0 through 2.14) that has multiple RCE vulnerabilities (see https://nvd.nist.gov/vuln/detail/CVE-2021-44228), the Log4J 1.2.x variant currently in use by Apache Helix has been End-of-Life since 2015 (https://logging.apache.org/log4j/1.2/) and has other known security vulnerabilities (e.g. https://nvd.nist.gov/vuln/detail/CVE-2019-17571). This comment from the Log4J project is worth a read: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126.
It seems like the most prudent course of action would be to upgrade the Apache Helix project to Log4J version 2.16.x that was released this week (https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4) to directly address these vulnerabilities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@helix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@helix.apache.org
For additional commands, e-mail: reviews-help@helix.apache.org
[GitHub] [helix] junkaixue closed issue #1921: Consider upgrading Log4J to version 2.16.x from Log4J 1.x to avoid known vulnerabilities
Posted by GitBox <gi...@apache.org>.
junkaixue closed issue #1921:
URL: https://github.com/apache/helix/issues/1921
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@helix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@helix.apache.org
For additional commands, e-mail: reviews-help@helix.apache.org