See the security advisory:
https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228
Uwe
Am 10. Dezember 2021 19:18:08 UTC schrieb Michael Schumann
:
>It looks like this affects Solr versions >= 7.4. Am I reading this correctly?
>
>
>References:
>https://www.luna
It looks like this affects Solr versions >= 7.4. Am I reading this correctly?
References:
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html
https://help.aliyun.com/noticelist/articleid/1060971232.html
ginal Message-
> From: Jason Gerlowski
> Sent: Friday, December 10, 2021 7:16 PM
> To: dev@solr.apache.org
> Subject: Re: Log4J RCE vulnerability
>
> Does anyone know whether ZooKeeper is affected at all? I checked
> their mailing list archive this morning to see if there was
eeting this, too.
>
>
>
> Uwe
>
>
>
> -
>
> Uwe Schindler
>
> Achterdiek 19, D-28357 Bremen
>
> https://www.thetaphi.de
>
> eMail: u...@thetaphi.de
>
>
>
> From: Cassandra Targett
> Sent: Friday, December 10, 2021 5:13 PM
> To: de
information on mailing list, too.
I am tweeting this, too.
Uwe
-
Uwe Schindler
Achterdiek 19, D-28357 Bremen
https://www.thetaphi.de
eMail: u...@thetaphi.de
From: Cassandra Targett
Sent: Friday, December 10, 2021 5:13 PM
To: dev@solr.apache.org
Subject: RE: Log4J RCE vulnerability
ould be fixed and by default all expansions on
> log messages were disabled:
> https://issues.apache.org/jira/browse/LOG4J2-3198
>
> -
> Uwe Schindler
> Achterdiek 19, D-28357 Bremen
> <https://www.google.com/maps/search/Achterdiek+19,+D-28357+Bremen?entry=gmail&source=g>
project-specific CVE.”
>
> Uwe
>
> -
> Uwe Schindler
> Achterdiek 19, D-28357 Bremen
> https://www.thetaphi.de
> eMail: u...@thetaphi.de
>
> From: Gus Heck
> Sent: Friday, December 10, 2021 1:32 PM
> To: dev@solr.apache.org
> Subject: Re: Log4J RCE vulnerability
-
Uwe Schindler
Achterdiek 19, D-28357 Bremen
https://www.thetaphi.de
eMail: u...@thetaphi.de
From: Gus Heck
Sent: Friday, December 10, 2021 1:32 PM
To: dev@solr.apache.org
Subject: Re: Log4J RCE vulnerability
In progress already it seems
<https://issues.apache.org/jira/bro
men
>> https://www.thetaphi.de
>> eMail: u...@thetaphi.de
>>
>> > -Original Message-
>> > From: Uwe Schindler
>> > Sent: Friday, December 10, 2021 11:10 AM
>> > To: dev@solr.apache.org
>> > Subject: RE: Log4J RCE vulnerability
>>
n?
> >
> > Man man, SNEAKY log4j!!! 😊
> >
> > Uwe
> >
> > -
> > Uwe Schindler
> > Achterdiek 19, D-28357 Bremen
> > https://www.thetaphi.de
> > eMail: u...@thetaphi.de
> >
> > > -Original Message-
> > > Fr
m: Uwe Schindler
> Sent: Friday, December 10, 2021 11:10 AM
> To: dev@solr.apache.org
> Subject: RE: Log4J RCE vulnerability
>
> In general the sysprop "log4j2.formatMsgNoLookups=true" fix is the only
> correct fix (maybe add it to the bootstrap class of solr). Updating log
On 10/12/2021 11.10, Uwe Schindler wrote:
In general the sysprop "log4j2.formatMsgNoLookups=true" fix is the only correct
fix (maybe add it to the bootstrap class of solr). Updating log4j is not really needed.
This prevents any of those shit. There's no reason ever to parse ${} escapes in log
essage-
> From: Uwe Schindler
> Sent: Friday, December 10, 2021 10:35 AM
> To: dev@solr.apache.org
> Subject: RE: Log4J RCE vulnerability
>
> Hi,
>
> I did some checks:
> - The problem also exists with logging parameters, so it is also executed if
> you
>
> -Original Message-
> From: Bram Van Dam
> Sent: Friday, December 10, 2021 8:31 AM
> To: dev@solr.apache.org
> Subject: Log4J RCE vulnerability
>
> Heads up:
>
> Seems like there's a pretty severe remote code execution vulnerability
> [1] in Log
Heads up:
Seems like there's a pretty severe remote code execution vulnerability
[1] in Log4J. Basically any application that uses log4j and that allows
user input to be injected into a logging string is susceptible. This
probably includes Solr.
Further interesting discussion on Hacker News
15 matches
Mail list logo
