[jira] [Commented] (LOG4J2-3254) Need a log4j-core version 2.16 osgi compatible

["Remko Popma (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/LOG4J2-3254?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461725#comment-17461725 ] 

Remko Popma commented on LOG4J2-3254:
-------------------------------------

Thank you for raising this.

I have started to look into this, but meanwhile can you try Log4j 2.12.2? That version does not have the fixes for 2.13, but it does have the security fixes (removes lookups in messaging and disables JNDI).

> Need a log4j-core version 2.16 osgi compatible
> ----------------------------------------------
>
>                 Key: LOG4J2-3254
>                 URL: https://issues.apache.org/jira/browse/LOG4J2-3254
>             Project: Log4j 2
>          Issue Type: Improvement
>          Components: Core, OSGi
>    Affects Versions: 2.16.0
>            Reporter: Marco Tenti
>            Priority: Major
>
> After the big security issue discovered with log4j2 , we need to update all the "old" osgi/karaf installation.
> When i run this piece of coce
> {code:sh}
> osgi:install -s mvn:org.apache.logging.log4j/log4j-core/2.13.0
> {code}
> is work fine with this :
> {code:sh}
> osgi:install -s mvn:org.apache.logging.log4j/log4j-core/2.16.0
> {code}
> I get this error :
> {code:sh}
> Error executing command: Error installing bundles:
>         Unable to start bundle mvn:org.apache.logging.log4j/log4j-core/2.16.0: org.osgi.framework.BundleException: Unable to resolve org.apache.logging.log4j.core [521](R 521.0): missing requirement [org.apache.logging.log4j.core [521](R 521.0)] osgi.wiring.package; (&(osgi.wiring.package=org.apache.logging.log4j)(version>=2.16.0)(!(version>=3.0.0))) Unresolved requirements: [[org.apache.logging.log4j.core [521](R 521.0)] osgi.wiring.package; (&(osgi.wiring.package=org.apache.logging.log4j)(version>=2.16.0)(!(version>=3.0.0)))]
> {code}
> it is a bug ? or i must use some other library ? i try to use [log4j-osgi (version 2.16)|https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-osgi/2.16.0] like this
> {code:sh}
> osgi:install -s mvn:org.apache.logging.log4j/log4j-osgi/2.16.0
> {code}
> it's work fine, but i still get the error from my bundles project:
> {code:sh}
> Error executing command: Error executing command on bundles:
>         Error starting bundle 515: Unable to resolve XXX [515](R 515.0): missing requirement [XXX [515](R 515.0)] osgi.wiring.package; (osgi.wiring.package=org.apache.logging.log4j.core) Unresolved requirements: [[XXX [515](R 515.0)] osgi.wiring.package; (osgi.wiring.package=org.apache.logging.log4j.core)]
> {code}
> this error is not happening with version 2.13



--
This message was sent by Atlassian Jira
(v8.20.1#820001)