ramanathan1504 commented on issue #4356: URL: https://github.com/apache/logging-log4j2/issues/4356#issuecomment-6122694791
@laikamanor, we does not treat that report as a vulnerability, see the [FAQ](https://logging.apache.org/security/faq.html#deserialization) and #4255. Still, the hardening changes from `2.x` are planned for 2.26.2 and are being ported in #4386. They include #4271, which removes the `MarshalledObject` path the advisory describes. The advisory itself is maintained by Sonatype, not by the Log4j project. Your scanner may keep showing it until Sonatype lists `2.26.2` as a fixed version. Until then, most tools let you mark it as not applicable if your application does not deserialize log events from untrusted sources. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
