You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@logging.apache.org by "Ralph Goers (Jira)" <ji...@apache.org> on 2021/12/21 06:10:00 UTC

[jira] [Commented] (LOG4J2-3265) CVE-2021-45105 fix for Java 7

    [ https://issues.apache.org/jira/browse/LOG4J2-3265?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17463008#comment-17463008 ] 

Ralph Goers commented on LOG4J2-3265:
-------------------------------------

Log4j 2.13.3 for Java 7 and Log4j 2.3.1 for Java 6 are being voted on tonight. Once everyone has had a chance to review them they will be released publicly.

> CVE-2021-45105 fix for Java 7
> -----------------------------
>
>                 Key: LOG4J2-3265
>                 URL: https://issues.apache.org/jira/browse/LOG4J2-3265
>             Project: Log4j 2
>          Issue Type: Bug
>            Reporter: Gobi
>            Priority: Major
>
> As per the NIST website [https://nvd.nist.gov/vuln/detail/CVE-2021-45105] it says this CVE fixed in log4j 2.12.3 but I could notice the download page [https://logging.apache.org/log4j/log4j-2.12.2/download.html] it says "2.12.2" was the last release for Java7 and no more support for Java7 and Java6
> Are you planning to release 2.12.3 or we should upgrade Java8 and apply log4j 2.17?
>  



--
This message was sent by Atlassian Jira
(v8.20.1#820001)