You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "grobmeier (via GitHub)" <gi...@apache.org> on 2023/08/16 08:28:20 UTC

[I] [MS5] SBOM Support & Security (logging-log4j2)

grobmeier opened a new issue, #1707:
URL: https://github.com/apache/logging-log4j2/issues/1707

   - [ ] Implement SBOM support
   - [ ] Add docs for using SBOM


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [MS5] SBOM Support & Security (logging-log4j2)

Posted by "grobmeier (via GitHub)" <gi...@apache.org>.
grobmeier commented on issue #1707:
URL: https://github.com/apache/logging-log4j2/issues/1707#issuecomment-1811353687

   Related to website improvements:
   https://github.com/apache/logging-site/commit/eff1c9a6f893d023b8d594a034d3c479262d1fbf
   https://github.com/apache/logging-site/commit/6aab16de13bef0533f130eb159b5af0dd9e85082
   https://github.com/apache/logging-site/commit/19074839c1babf04c75e6a1657bb78b652da838c
   https://github.com/apache/logging-site/commit/bf902d8743c71dded40e4e92af67635a1247717b
   https://github.com/apache/logging-site/commit/caa65e33ed4b93d03c905d10bef4612a1608de72
   https://github.com/apache/logging-site/commit/40e6432308b3dbccd04f704eaf1e10175d5ae3a6
   among others.
    


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [MS5] SBOM Support & Security (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on issue #1707:
URL: https://github.com/apache/logging-log4j2/issues/1707#issuecomment-1774567679

   We should also consider including a [VEX](https://cyclonedx.org/capabilities/vex/) and/or [VDR](https://cyclonedx.org/capabilities/vdr/) report.
   
   These could double the information we already provided in the Github "Security" tab. For example we could dismiss:
   
   - [Apache Cassandra: Privilege escalation when enabling FQL/Audit logs](https://github.com/apache/logging-log4j2/security/dependabot/48),
   - [Improper Access Control in SLF4J](https://github.com/apache/logging-log4j2/security/dependabot/26) caused by the usage of SLF4J Ext 1.7.25 (before the breaking change in 1.7.26). @rgoers, do we still need to support `org.slf4j.ext.EventData` or can we drop the feature?
   - [Guava vulnerable to insecure use of temporary directory](https://github.com/apache/logging-log4j2/security/dependabot/37). Cassandra is holding back our Guava version: it can not work with Guava higher than 25.x or so.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [MS5] SBOM Support & Security (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz closed issue #1707: [MS5] SBOM Support & Security
URL: https://github.com/apache/logging-log4j2/issues/1707


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [MS5] SBOM Support & Security (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on issue #1707:
URL: https://github.com/apache/logging-log4j2/issues/1707#issuecomment-1770303333

   Discussion related to SBOM:
   
   - ["SBOM" thread](https://lists.apache.org/thread/j70ky0rr1wfw29lnnmycwkm48tlhm0yg) on the `dev` mailing list.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [MS5] SBOM Support & Security (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on issue #1707:
URL: https://github.com/apache/logging-log4j2/issues/1707#issuecomment-1774193460

   The problem with the `distribution` link was reported in CycloneDX/cyclonedx-maven-plugin#245


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org