You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/02/11 08:22:41 UTC
[GitHub] [pulsar] ethqunzhong opened a new issue #14237: [Security] Should Upgrade Log4j to 2.17.1 in Prometheus Client dependency
ethqunzhong opened a new issue #14237:
URL: https://github.com/apache/pulsar/issues/14237
**Describe the bug**
#13552 has fix log4j2 security bug
after build pulsar source code
in generate dir, apache-pulsar-2.10.0-SNAPSHOT/lib
third party dependency lib as follow:
<img width="639" alt="image" src="https://user-images.githubusercontent.com/16517186/153557338-f775c4e6-edcd-48cf-ac6f-0e1d27f7fb11.png">
check this lib's pom.xml as follow, which log4j2 version is 2.1 low then 2.17.1
<img width="548" alt="image" src="https://user-images.githubusercontent.com/16517186/153557002-41f1672e-ed9a-463c-80e8-26faa69f3a57.png">
in public maven repo, io.prometheus.simpleclient_log4j2 latest version is 0.15.0 which depend log4j2 version update to 2.17.1
link to https://mvnrepository.com/artifact/io.prometheus/simpleclient_log4j2/0.15.0
should we upgrade io.prometheus.simpleclient_log4j2 version from 0.5.0 to latest(0.15.0) to avoid log4j2 security holes?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] ethqunzhong commented on issue #14237: [Security] Should Upgrade Log4j to 2.17.1 in Prometheus Client dependency
Posted by GitBox <gi...@apache.org>.
ethqunzhong commented on issue #14237:
URL: https://github.com/apache/pulsar/issues/14237#issuecomment-1035994333
> #13785 is trying to solve this
thx reply.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] ethqunzhong closed issue #14237: [Security] Should Upgrade Log4j to 2.17.1 in Prometheus Client dependency
Posted by GitBox <gi...@apache.org>.
ethqunzhong closed issue #14237:
URL: https://github.com/apache/pulsar/issues/14237
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Shoothzj commented on issue #14237: [Security] Should Upgrade Log4j to 2.17.1 in Prometheus Client dependency
Posted by GitBox <gi...@apache.org>.
Shoothzj commented on issue #14237:
URL: https://github.com/apache/pulsar/issues/14237#issuecomment-1035984356
#13785 is trying to solve this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org