[GitHub] [solr] mario-canva edited a comment on pull request #454: SOLR-15843 Update Log4J to 2.15

[GitBox <gi...@apache.org>]

mario-canva edited a comment on pull request #454:
URL: https://github.com/apache/solr/pull/454#issuecomment-994124565


   Thanks @uschindler appreciate the quick response! However, their advisory also states other attack vectors may be possible:
   
   > The reason these measures are insufficient is that, in addition to the Thread Context attack vector mentioned above, there are still code paths in Log4j where message lookups could occur: known examples are applications that use Logger.printf("%s", userInput), or applications that use a custom message factory, where the resulting messages do not implement StringBuilderFormattable. There may be other attack vectors.
   
   At the moment we are going with the mitigation they suggested here:
   
   > remove the JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org