You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shardingsphere.apache.org by GitBox <gi...@apache.org> on 2022/01/22 03:02:32 UTC
[GitHub] [shardingsphere] fbin87 opened a new issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
fbin87 opened a new issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993
On January 20, 2022, PSIRT monitoring found that Apache officially released the risk notice of Log4j (version 1.x), the vulnerability numbers are CVE-2022-23302, CVE-2022-23305, CVE-2022-23307. Vulnerability Rating: Critical, Vulnerability Score: 9.8. These vulnerabilities only affect Log4j 1.x versions, and Log4j 2 versions are not affected.
After analysis, it was found that the log4j 1.x version was passively dependenced through zookeeper and other modules in the sharding source code.
mvn tree:
[INFO] +- org.apache.curator:curator-client:jar:2.10.0:compile
[INFO] | \- org.apache.zookeeper:zookeeper:jar:3.4.6:compile
[INFO] | +- log4j:log4j:jar:1.2.16:compile
[INFO] | \- jline:jline:jar:0.9.94:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-logging:jar:1.5.22.RELEASE:provided
[INFO] | | +- org.slf4j:jul-to-slf4j:jar:1.7.7:provided
[INFO] | | \- org.slf4j:log4j-over-slf4j:jar:1.7.26:provided
Will sharding versions 4.1.1 and 3.1.0 be affected? If so, is there an upgrade plan? Waiting for the reply eagerly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] fbin87 removed a comment on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
fbin87 removed a comment on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020931322
> Hi @fbin87 The 4.1.1 and 3.1.0 are no longer maintained.
tags 4.1.1 is the second newest version and is not maintained? What is the latest version maintained now, is 5.0.0 ？
In which versions are the above vulnerabilities resolved?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] fbin87 commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
fbin87 commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020931322
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] TeslaCN commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
TeslaCN commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020769634
Hi @fbin87
The 4.1.1 and 3.1.0 are no longer maintained.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] fbin87 commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
fbin87 commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020931865
> Hi @fbin87 The 4.1.1 and 3.1.0 are no longer maintained.
In which versions are the above vulnerabilities resolved? version 5.0.0 ？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] TeslaCN commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
TeslaCN commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1022240599
> In which versions are the above vulnerabilities resolved? version 5.0.0 ？
You may check the dependencies of the master branch or tag `5.1.0`. Welcome to submit a PR if vulnerabilities exists.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] fbin87 commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
fbin87 commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020931322
> Hi @fbin87 The 4.1.1 and 3.1.0 are no longer maintained.
tags 4.1.1 is the second newest version and is not maintained? What is the latest version maintained now, is 5.0.0 ？
In which versions are the above vulnerabilities resolved?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] fbin87 removed a comment on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
fbin87 removed a comment on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020931322
> Hi @fbin87 The 4.1.1 and 3.1.0 are no longer maintained.
tags 4.1.1 is the second newest version and is not maintained? What is the latest version maintained now, is 5.0.0 ？
In which versions are the above vulnerabilities resolved?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] TeslaCN commented on issue #14993: About the security vulnerability of the Log4j 1.x version in ShardingSphere 4.1.1 and 3.1.0
Posted by GitBox <gi...@apache.org>.
TeslaCN commented on issue #14993:
URL: https://github.com/apache/shardingsphere/issues/14993#issuecomment-1020769634
Hi @fbin87
The 4.1.1 and 3.1.0 are no longer maintained.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org