You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by vy...@apache.org on 2023/02/03 13:33:23 UTC
[logging-log4j-site] branch asf-site updated (145b31192 -> 45614b0ad)
This is an automated email from the ASF dual-hosted git repository.
vy pushed a change to branch asf-site
in repository https://gitbox.apache.org/repos/asf/logging-log4j-site.git
from 145b31192 Add Tidelift to support page
new e29ea849c Update security page to reflect that config access won't qualify
new 45614b0ad Update security page to reflect that config access won't qualify
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
log4j-2.18.0/security.html | 4 +++-
log4j-2.19.0/security.html | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
[logging-log4j-site] 02/02: Update security page to reflect that config access won't qualify
Posted by vy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/logging-log4j-site.git
commit 45614b0ad74c926392f72872f4b0682f89fdc2dc
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Fri Feb 3 14:34:09 2023 +0100
Update security page to reflect that config access won't qualify
---
log4j-2.19.0/security.html | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/log4j-2.19.0/security.html b/log4j-2.19.0/security.html
index f012f233d..2d7ecdf6b 100644
--- a/log4j-2.19.0/security.html
+++ b/log4j-2.19.0/security.html
@@ -179,7 +179,9 @@ to mitigate the known vulnerabilities listed here, please
Log4j <a href="mail-lists.html">Users mailing list</a>.</p>
<p>If you have encountered an unlisted security vulnerability or other unexpected behaviour
that has security impact, or if the descriptions here are incomplete, please report them
-privately to the <a class="externalLink" href="mailto:security@logging.apache.org">Log4j Security Team</a>. Thank you!</p>
+privately to <a class="externalLink" href="mailto:security@logging.apache.org">the Log4j Security Team</a>.
+Note that reports assuming attacker's access to the Log4j configuration will not qualify as a vulnerability.
+Thank you for your understanding and help!</p>
<p><a name="CVE-2021-44832"></a><a name="cve-2021-44832"></a></p><section>
<h2><a name="Fixed_in_Log4j_2.17.1_.28Java_8.29.2C_2.12.4_.28Java_7.29_and_2.3.2_.28Java_6.29"></a><a name="log4j-2.17.1"></a> Fixed in Log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6)</h2>
<p><a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832">CVE-2021-44832</a>:
[logging-log4j-site] 01/02: Update security page to reflect that config access won't qualify
Posted by vy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/logging-log4j-site.git
commit e29ea849c590ff7fd9ced4d7081ddd1da0f4c43c
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Fri Feb 3 14:32:37 2023 +0100
Update security page to reflect that config access won't qualify
---
log4j-2.18.0/security.html | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/log4j-2.18.0/security.html b/log4j-2.18.0/security.html
index 0f4f00715..205809a77 100644
--- a/log4j-2.18.0/security.html
+++ b/log4j-2.18.0/security.html
@@ -180,7 +180,9 @@ to mitigate the known vulnerabilities listed here, please
Log4j <a href="mail-lists.html">Users mailing list</a>.</p>
<p>If you have encountered an unlisted security vulnerability or other unexpected behaviour
that has security impact, or if the descriptions here are incomplete, please report them
-privately to the <a class="externalLink" href="mailto:security@logging.apache.org">Log4j Security Team</a>. Thank you!</p>
+privately to <a class="externalLink" href="mailto:security@logging.apache.org">the Log4j Security Team</a>.
+Note that reports assuming attacker's access to the Log4j configuration will not qualify as a vulnerability.
+Thank you for your understanding and help!</p>
<p><a name="CVE-2021-44832"></a><a name="cve-2021-44832"></a></p><section>
<h2><a name="Fixed_in_Log4j_2.17.1_.28Java_8.29.2C_2.12.4_.28Java_7.29_and_2.3.2_.28Java_6.29"></a><a name="log4j-2.17.1"></a> Fixed in Log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6)</h2>
<p><a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832">CVE-2021-44832</a>: