You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by vy...@apache.org on 2023/11/08 09:00:57 UTC
(logging-log4j2) branch security-page updated (0524572e8f -> 2f36628811)
This is an automated email from the ASF dual-hosted git repository.
vy pushed a change to branch security-page
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
from 0524572e8f Use Maven-like mathematical notation for version ranges (#1707)
new e2660a5d1c Switch to CVSSv2 for CVE-2017-5645 (#1707)
new 2f36628811 Improve wording
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
src/site/asciidoc/security.adoc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
(logging-log4j2) 02/02: Improve wording
Posted by vy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch security-page
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit 2f3662881185b85337dbc73bd22cf38f674a5189
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Wed Nov 8 10:00:56 2023 +0100
Improve wording
---
src/site/asciidoc/security.adoc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/site/asciidoc/security.adoc b/src/site/asciidoc/security.adoc
index 9416828384..28df58bea9 100644
--- a/src/site/asciidoc/security.adoc
+++ b/src/site/asciidoc/security.adoc
@@ -43,7 +43,7 @@ If you have encountered an unlisted security vulnerability or other unexpected b
[WARNING]
====
-Reports assuming attacker's access to the Log4j configuration will not qualify as a vulnerability.
+The threat model that Log4j uses considers configuration files as safe input controlled by the programmer; **potential vulnerabilities that require the ability to modify a configuration are not considered vulnerabilities** as the required access to do so implies the attacker can execute arbitrary code.
====
[#policy]
@@ -51,7 +51,7 @@ Reports assuming attacker's access to the Log4j configuration will not qualify a
The Apache Log4j Security Team follows the https://www.apache.org/security/committers.html[ASF Project Security] guide for handling security vulnerabilities.
-Found security vulnerabilities are subject to voting (by means of https://logging.apache.org/guidelines.html[_lazy approval_], preferably) in the private mailto:security@logging.apache.org[security mailing list] before creating a CVE and populating its associated content.
+Reported security vulnerabilities are subject to voting (by means of https://logging.apache.org/guidelines.html[_lazy approval_], preferably) in the private mailto:security@logging.apache.org[security mailing list] before creating a CVE and populating its associated content.
This procedure involves only the creation of CVEs and blocks neither (vulnerability) fixes, nor releases.
[#vulnerabilities]
(logging-log4j2) 01/02: Switch to CVSSv2 for CVE-2017-5645 (#1707)
Posted by vy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch security-page
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit e2660a5d1cd752b51d4816ee16a407c1f21430d4
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Wed Nov 8 09:47:24 2023 +0100
Switch to CVSSv2 for CVE-2017-5645 (#1707)
---
src/site/asciidoc/security.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/site/asciidoc/security.adoc b/src/site/asciidoc/security.adoc
index e49ebb9999..9416828384 100644
--- a/src/site/asciidoc/security.adoc
+++ b/src/site/asciidoc/security.adoc
@@ -283,7 +283,7 @@ This issue was discovered by Peter Stöckli.
[cols="1h,5"]
|===
|Summary |TCP/UDP socket servers can be exploited to execute arbitrary code
-|CVSS 3.x Score & Vector |9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
+|CVSS 2.0 Score & Vector |7.5 HIGH (AV:N/AC:L/Au:N/C:P/I:P/A:P)
|Components affected |`log4j-core`
|Versions affected |`[2.0-alpha1, 2.8.2)`
|Versions fixed |`2.8.2` (Java 7)