You are viewing a plain text version of this content. The canonical link for it is here.
Posted to log4j-dev@logging.apache.org by Nick Williams <ni...@nicholaswilliams.net> on 2013/06/19 01:35:02 UTC
CVE-2013-1571, VU#225657
Oracle has announced a Javadoc vulnerability (CVE-2013-1571 [1], VU#225657 [2]) whereby Javadoc generated with Java 5, Java 6, or Java 7 < 7u25 is vulnerable to a frame injection attack. Oracle has provided a repair-in-place tool for Javadoc that cannot be easily interpreted, but is urging developers to regenerate whatever Javadoc they can using Java 7u25. For all practical purses, the vulnerability really only applies to publicly-hosted Javadoc, so the Javadoc in our existing Maven artifacts really doesn't have to be worried about (not that we could do anything about it). My thoughts on this:
1) We should apply the repair-in-place tool ASAP to the Javadoc on the website for Log4j 1 and Log4j 2.
2) Future Log4j 1 and 2 Javadoc should be generated with 7u25 or better. There will be no fix for Java 5 or 6. Thankfully, generating Javadoc using a different JDK than you used to compile is quite easy in both Maven and Ant. In fact, I prefer it that way, because the Javadoc is much more visually attractive in Java 7.
I will file an issue about this two, but I wanted to go ahead and make the list aware.
Nick
[1] http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
[2] http://www.kb.cert.org/vuls/id/225657
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-dev-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-dev-help@logging.apache.org
Re: CVE-2013-1571, VU#225657
Posted by Christian Grobmeier <gr...@gmail.com>.
Thanks Nicholas.
We indeed need to do something now. Lucky us, we are on the ASF CMS.
So basically, checking out the latest tag, javadoc'ing with j7u25 and
reuploading to the CMS should do the trick.
Didn't find much on the repair-in-place tool, but the recommendation
is to regenerate, so i am all for regenerating. I hope I'll find some
time for log4j1, if somebody else is interest.. speak up.
On Wed, Jun 19, 2013 at 1:35 AM, Nick Williams
<ni...@nicholaswilliams.net> wrote:
> Oracle has announced a Javadoc vulnerability (CVE-2013-1571 [1], VU#225657 [2]) whereby Javadoc generated with Java 5, Java 6, or Java 7 < 7u25 is vulnerable to a frame injection attack. Oracle has provided a repair-in-place tool for Javadoc that cannot be easily interpreted, but is urging developers to regenerate whatever Javadoc they can using Java 7u25. For all practical purses, the vulnerability really only applies to publicly-hosted Javadoc, so the Javadoc in our existing Maven artifacts really doesn't have to be worried about (not that we could do anything about it). My thoughts on this:
>
> 1) We should apply the repair-in-place tool ASAP to the Javadoc on the website for Log4j 1 and Log4j 2.
>
> 2) Future Log4j 1 and 2 Javadoc should be generated with 7u25 or better. There will be no fix for Java 5 or 6. Thankfully, generating Javadoc using a different JDK than you used to compile is quite easy in both Maven and Ant. In fact, I prefer it that way, because the Javadoc is much more visually attractive in Java 7.
>
> I will file an issue about this two, but I wanted to go ahead and make the list aware.
>
> Nick
>
> [1] http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
> [2] http://www.kb.cert.org/vuls/id/225657
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: log4j-dev-unsubscribe@logging.apache.org
> For additional commands, e-mail: log4j-dev-help@logging.apache.org
>
--
http://www.grobmeier.de
https://www.timeandbill.de
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-dev-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-dev-help@logging.apache.org
Re: CVE-2013-1571, VU#225657
Posted by Nick Williams <ni...@nicholaswilliams.net>.
- for Javadoc that cannot be easily interpreted
+ for Javadoc that cannot be easily regenerated
Not even sure how that happened...
On Jun 18, 2013, at 6:35 PM, Nick Williams wrote:
> Oracle has announced a Javadoc vulnerability (CVE-2013-1571 [1], VU#225657 [2]) whereby Javadoc generated with Java 5, Java 6, or Java 7 < 7u25 is vulnerable to a frame injection attack. Oracle has provided a repair-in-place tool for Javadoc that cannot be easily interpreted, but is urging developers to regenerate whatever Javadoc they can using Java 7u25. For all practical purses, the vulnerability really only applies to publicly-hosted Javadoc, so the Javadoc in our existing Maven artifacts really doesn't have to be worried about (not that we could do anything about it). My thoughts on this:
>
> 1) We should apply the repair-in-place tool ASAP to the Javadoc on the website for Log4j 1 and Log4j 2.
>
> 2) Future Log4j 1 and 2 Javadoc should be generated with 7u25 or better. There will be no fix for Java 5 or 6. Thankfully, generating Javadoc using a different JDK than you used to compile is quite easy in both Maven and Ant. In fact, I prefer it that way, because the Javadoc is much more visually attractive in Java 7.
>
> I will file an issue about this two, but I wanted to go ahead and make the list aware.
>
> Nick
>
> [1] http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
> [2] http://www.kb.cert.org/vuls/id/225657
>
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-dev-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-dev-help@logging.apache.org