You are viewing a plain text version of this content. The canonical link for it is here.

Posted to common-issues@hadoop.apache.org by "Ayush Saxena (Jira)" <ji...@apache.org> on 2021/12/17 14:03:00 UTC

[jira] [Commented] (HADOOP-18050) Document Hadoop's stance on the log4jshell vulnerability

    [ https://issues.apache.org/jira/browse/HADOOP-18050?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461453#comment-17461453 ] 

Ayush Saxena commented on HADOOP-18050:
---------------------------------------

yeps, make sense. Better to keep it on our homepage. Most of the people are checking there only. And there is tooo much traffic asking about that on MLs

BTW. Apache too had a blog, which mentioned hadoop isn't vulnerable. 

https://blogs.apache.org/security/entry/cve-2021-44228

> Document Hadoop's stance on the log4jshell vulnerability
> --------------------------------------------------------
>
>                 Key: HADOOP-18050
>                 URL: https://issues.apache.org/jira/browse/HADOOP-18050
>             Project: Hadoop Common
>          Issue Type: Task
>          Components: documentation
>            Reporter: Wei-Chiu Chuang
>            Assignee: Wei-Chiu Chuang
>            Priority: Major
>
> As of today, Hadoop relies on log4j-1, not log4j2. It is understood that the log4jshell vulnerability (CVE-2021-44228) does not impact log4j-1. Given the widespread attention to the incidence, we should make it clear that Hadoop is not susceptible to the attack.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org