You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@camel.apache.org by Francois Papon <fr...@openobject.fr> on 2022/01/03 15:27:26 UTC
Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Hi,
The Camel elasticsearch-rest-component depend on the version 7.10.2 of
elasticsearch-client that has a dependency on log4j-core:2.13.3 and
log4j-api:2.13.3
When installating the Karaf feature the log4j bundles are installed:
https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
There is a comment about upgrading but with a warning about other
features compatibility.
Does anyone has some information about this?
Do we need to upgrade?
The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
May be Servicemix bundle should be update too.
Regards,
Francois
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Francois Papon <fr...@openobject.fr>.
I will made some tests on camel-karaf main branch because I made it work
on a custom Karaf distribution by adding blacklisted bundle.
However I don't install all the features but it's weird because in the
feature.xml of camel-karaf, only the elasticsearch feature depend on log4j.
On 03/01/2022 16:47, Andrea Cosentino wrote:
> If you run a full feature install like we do in camel-karaf it will fail.
>
> This the only test i've done around ES feature
>
> Il lun 3 gen 2022, 16:46 Francois Papon <fr...@openobject.fr> ha
> scritto:
>
>> The range of the import package is
>> org.apache.logging.log4j;version="[2.8,4)" in the servicemix bundle so
>> it should work if we only upgrade log4j version no?
>>
>> May be I missed somethings.
>>
>> On 03/01/2022 16:33, Andrea Cosentino wrote:
>>> No, the installation will fail if you update the feature without
>> upgrading
>>> elasticsearch bundle.
>>>
>>> We cannot update the ES bundle for the license problem.
>>>
>>> Il giorno lun 3 gen 2022 alle ore 16:31 Francois Papon <
>>> francois.papon@openobject.fr> ha scritto:
>>>
>>>> Ok, so just updating the feature should be enought.
>>>>
>>>> On 03/01/2022 16:29, Andrea Cosentino wrote:
>>>>> Elasticsearch high level client and all the related stuff changed their
>>>>> license after 7.10.2
>>>>>
>>>>> As far as I know is not compatible with ASF License.
>>>>>
>>>>> This is the reason is not updated.
>>>>>
>>>>> Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
>>>>> francois.papon@openobject.fr> ha scritto:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
>>>>>> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
>>>>>> log4j-api:2.13.3
>>>>>>
>>>>>> When installating the Karaf feature the log4j bundles are installed:
>>>>>>
>>>>>>
>>>>>>
>> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>>>>>> There is a comment about upgrading but with a warning about other
>>>>>> features compatibility.
>>>>>>
>>>>>> Does anyone has some information about this?
>>>>>>
>>>>>> Do we need to upgrade?
>>>>>>
>>>>>> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>>>>>>
>>>>>> May be Servicemix bundle should be update too.
>>>>>>
>>>>>> Regards,
>>>>>>
>>>>>> Francois
>>>>>>
>>>>>>
>>>>>>
>>>>>>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Andrea Cosentino <an...@gmail.com>.
If you run a full feature install like we do in camel-karaf it will fail.
This the only test i've done around ES feature
Il lun 3 gen 2022, 16:46 Francois Papon <fr...@openobject.fr> ha
scritto:
> The range of the import package is
> org.apache.logging.log4j;version="[2.8,4)" in the servicemix bundle so
> it should work if we only upgrade log4j version no?
>
> May be I missed somethings.
>
> On 03/01/2022 16:33, Andrea Cosentino wrote:
> > No, the installation will fail if you update the feature without
> upgrading
> > elasticsearch bundle.
> >
> > We cannot update the ES bundle for the license problem.
> >
> > Il giorno lun 3 gen 2022 alle ore 16:31 Francois Papon <
> > francois.papon@openobject.fr> ha scritto:
> >
> >> Ok, so just updating the feature should be enought.
> >>
> >> On 03/01/2022 16:29, Andrea Cosentino wrote:
> >>> Elasticsearch high level client and all the related stuff changed their
> >>> license after 7.10.2
> >>>
> >>> As far as I know is not compatible with ASF License.
> >>>
> >>> This is the reason is not updated.
> >>>
> >>> Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
> >>> francois.papon@openobject.fr> ha scritto:
> >>>
> >>>> Hi,
> >>>>
> >>>> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
> >>>> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
> >>>> log4j-api:2.13.3
> >>>>
> >>>> When installating the Karaf feature the log4j bundles are installed:
> >>>>
> >>>>
> >>>>
> >>
> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
> >>>> There is a comment about upgrading but with a warning about other
> >>>> features compatibility.
> >>>>
> >>>> Does anyone has some information about this?
> >>>>
> >>>> Do we need to upgrade?
> >>>>
> >>>> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
> >>>>
> >>>> May be Servicemix bundle should be update too.
> >>>>
> >>>> Regards,
> >>>>
> >>>> Francois
> >>>>
> >>>>
> >>>>
> >>>>
>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Francois Papon <fr...@openobject.fr>.
The range of the import package is
org.apache.logging.log4j;version="[2.8,4)" in the servicemix bundle so
it should work if we only upgrade log4j version no?
May be I missed somethings.
On 03/01/2022 16:33, Andrea Cosentino wrote:
> No, the installation will fail if you update the feature without upgrading
> elasticsearch bundle.
>
> We cannot update the ES bundle for the license problem.
>
> Il giorno lun 3 gen 2022 alle ore 16:31 Francois Papon <
> francois.papon@openobject.fr> ha scritto:
>
>> Ok, so just updating the feature should be enought.
>>
>> On 03/01/2022 16:29, Andrea Cosentino wrote:
>>> Elasticsearch high level client and all the related stuff changed their
>>> license after 7.10.2
>>>
>>> As far as I know is not compatible with ASF License.
>>>
>>> This is the reason is not updated.
>>>
>>> Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
>>> francois.papon@openobject.fr> ha scritto:
>>>
>>>> Hi,
>>>>
>>>> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
>>>> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
>>>> log4j-api:2.13.3
>>>>
>>>> When installating the Karaf feature the log4j bundles are installed:
>>>>
>>>>
>>>>
>> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>>>> There is a comment about upgrading but with a warning about other
>>>> features compatibility.
>>>>
>>>> Does anyone has some information about this?
>>>>
>>>> Do we need to upgrade?
>>>>
>>>> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>>>>
>>>> May be Servicemix bundle should be update too.
>>>>
>>>> Regards,
>>>>
>>>> Francois
>>>>
>>>>
>>>>
>>>>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Andrea Cosentino <an...@gmail.com>.
No, the installation will fail if you update the feature without upgrading
elasticsearch bundle.
We cannot update the ES bundle for the license problem.
Il giorno lun 3 gen 2022 alle ore 16:31 Francois Papon <
francois.papon@openobject.fr> ha scritto:
> Ok, so just updating the feature should be enought.
>
> On 03/01/2022 16:29, Andrea Cosentino wrote:
> > Elasticsearch high level client and all the related stuff changed their
> > license after 7.10.2
> >
> > As far as I know is not compatible with ASF License.
> >
> > This is the reason is not updated.
> >
> > Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
> > francois.papon@openobject.fr> ha scritto:
> >
> >> Hi,
> >>
> >> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
> >> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
> >> log4j-api:2.13.3
> >>
> >> When installating the Karaf feature the log4j bundles are installed:
> >>
> >>
> >>
> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
> >>
> >> There is a comment about upgrading but with a warning about other
> >> features compatibility.
> >>
> >> Does anyone has some information about this?
> >>
> >> Do we need to upgrade?
> >>
> >> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
> >>
> >> May be Servicemix bundle should be update too.
> >>
> >> Regards,
> >>
> >> Francois
> >>
> >>
> >>
> >>
>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Francois Papon <fr...@openobject.fr>.
Ok, so just updating the feature should be enought.
On 03/01/2022 16:29, Andrea Cosentino wrote:
> Elasticsearch high level client and all the related stuff changed their
> license after 7.10.2
>
> As far as I know is not compatible with ASF License.
>
> This is the reason is not updated.
>
> Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
> francois.papon@openobject.fr> ha scritto:
>
>> Hi,
>>
>> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
>> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
>> log4j-api:2.13.3
>>
>> When installating the Karaf feature the log4j bundles are installed:
>>
>>
>> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>>
>> There is a comment about upgrading but with a warning about other
>> features compatibility.
>>
>> Does anyone has some information about this?
>>
>> Do we need to upgrade?
>>
>> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>>
>> May be Servicemix bundle should be update too.
>>
>> Regards,
>>
>> Francois
>>
>>
>>
>>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Andrea Cosentino <an...@gmail.com>.
Elasticsearch high level client and all the related stuff changed their
license after 7.10.2
As far as I know is not compatible with ASF License.
This is the reason is not updated.
Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
francois.papon@openobject.fr> ha scritto:
> Hi,
>
> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
> log4j-api:2.13.3
>
> When installating the Karaf feature the log4j bundles are installed:
>
>
> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>
> There is a comment about upgrading but with a warning about other
> features compatibility.
>
> Does anyone has some information about this?
>
> Do we need to upgrade?
>
> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>
> May be Servicemix bundle should be update too.
>
> Regards,
>
> Francois
>
>
>
>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Andrea Cosentino <an...@gmail.com>.
Elasticsearch high level client and all the related stuff changed their
license after 7.10.2
As far as I know is not compatible with ASF License.
This is the reason is not updated.
Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
francois.papon@openobject.fr> ha scritto:
> Hi,
>
> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
> log4j-api:2.13.3
>
> When installating the Karaf feature the log4j bundles are installed:
>
>
> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>
> There is a comment about upgrading but with a warning about other
> features compatibility.
>
> Does anyone has some information about this?
>
> Do we need to upgrade?
>
> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>
> May be Servicemix bundle should be update too.
>
> Regards,
>
> Francois
>
>
>
>
Re: Karaf/Camel camel-elasticsearch-rest component and Log4jShell
Posted by Andrea Cosentino <an...@gmail.com>.
Elasticsearch high level client and all the related stuff changed their
license after 7.10.2
As far as I know is not compatible with ASF License.
This is the reason is not updated.
Il giorno lun 3 gen 2022 alle ore 16:27 Francois Papon <
francois.papon@openobject.fr> ha scritto:
> Hi,
>
> The Camel elasticsearch-rest-component depend on the version 7.10.2 of
> elasticsearch-client that has a dependency on log4j-core:2.13.3 and
> log4j-api:2.13.3
>
> When installating the Karaf feature the log4j bundles are installed:
>
>
> https://github.com/apache/camel-karaf/blob/e976acc7c1d6405b283ffe3e69d336aab854bd5b/pom.xml#L232
>
> There is a comment about upgrading but with a warning about other
> features compatibility.
>
> Does anyone has some information about this?
>
> Do we need to upgrade?
>
> The Elasticsearch team upgraded to log4j:2.17.0 on 7.16.2.
>
> May be Servicemix bundle should be update too.
>
> Regards,
>
> Francois
>
>
>
>