[GitHub] [druid] FrankChen021 commented on pull request #12051: update log4j to 2.15.0 to address security vulnerabilities

[GitBox <gi...@apache.org>]

FrankChen021 commented on pull request #12051:
URL: https://github.com/apache/druid/pull/12051#issuecomment-995361286


   @GElkayam I checked the description of that CVE. If I understand correctly, this vulnerability exists when thread context map pattern layout is applied. 
   
   Since Druid's default log4j2 configuration does not use such pattern layout, I think it's not affected by this problem.
   
   > This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org