[GitHub] [hadoop-site] steveloughran commented on pull request #34: HADOOP-18050. Document Hadoop's stance on the log4jshell vulnerability.

[GitBox <gi...@apache.org>]

steveloughran commented on pull request #34:
URL: https://github.com/apache/hadoop-site/pull/34#issuecomment-996779017


   should we explicitly say 
   * no ASF version of hadoop has ever been vulnerable 
   * third party products may be vulnerable: consult the vendor 
   * and how log4j 1.2.17 does have a vulnerability if a service is deployed, but this isnt done - and you can remove the jar (link to the cloudera jar?)
   u
   akso warn that 
   * apps which run on hadoop may be vulneramble -check with the supplier 
   * if you do find yourself replacing JARs, you MUST check and update the tar.gz files in hdfs, e.g distcp.tar.gz
   
   if i could code, id be playing with the `hadoop findclass` command to see how it couox be used here... you should be able to use it to verify the jndi resolver is not on the classpath
   
   has anyone tried that


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org