[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-16 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r771167930 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[GitHub] [logging-log4cxx] coldtobi commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-16 Thread GitBox
coldtobi commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r771167930 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[jira] [Comment Edited] (LOG4J2-3235) Exception: Invalid byte tag in constant pool: 19 for module-info.class Java 7

2021-12-16 Thread Saptarshi De (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461236#comment-17461236 ] Saptarshi De edited comment on LOG4J2-3235 at 12/17/21, 7:12 AM: -

[jira] [Commented] (LOG4J2-3235) Exception: Invalid byte tag in constant pool: 19 for module-info.class Java 7

2021-12-16 Thread Saptarshi De (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461236#comment-17461236 ] Saptarshi De commented on LOG4J2-3235: -- Hi [~ggregory]  Really appreciate your inp

[jira] [Commented] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Sascha Volkenandt (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461227#comment-17461227 ] Sascha Volkenandt commented on LOG4J2-3243: --- Just to clarify: A) I am not tal

[jira] [Resolved] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory resolved LOG4J2-3237. - Fix Version/s: 2.16.1 Resolution: Fixed In git branch {{{}release-2.x{}}}. > Log

[jira] [Commented] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP

2021-12-16 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461180#comment-17461180 ] ASF subversion and git services commented on LOG4J2-3237: - Commi

[jira] [Commented] (LOG4J2-3208) Disable JNDI by default

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3208?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461178#comment-17461178 ] Matt Sicker commented on LOG4J2-3208: - [~512196557]: for JNDI, no, 2.16.0 should be

[jira] [Commented] (LOG4J2-3208) Disable JNDI by default

2021-12-16 Thread Jira
[ https://issues.apache.org/jira/browse/LOG4J2-3208?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461175#comment-17461175 ] 方恒 commented on LOG4J2-3208: 听说 2.16版本也被绕过了,请问是真的吗?:( > Disable JNDI by default > -

[jira] [Created] (LOG4J2-3250) Consider remove recursive replace for lookups

2021-12-16 Thread Yanming Zhou (Jira)
Yanming Zhou created LOG4J2-3250: Summary: Consider remove recursive replace for lookups Key: LOG4J2-3250 URL: https://issues.apache.org/jira/browse/LOG4J2-3250 Project: Log4j 2 Issue Type: I

[jira] [Updated] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Carter Kozak (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Carter Kozak updated LOG4J2-3230: - Fix Version/s: 2.17.0 > Certain strings can cause infinite recursion > -

[jira] [Updated] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory updated LOG4J2-3237: Summary: Log4j 1.2 bridge API hard codes protocol to TCP (was: Log4j 1.2 bridge API hard

[jira] [Assigned] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory reassigned LOG4J2-3237: --- Assignee: Gary D. Gregory > Log4j 1.2 bridge API hard codes protocol to TCP and hos

[GitHub] [logging-log4j2] fulldecent commented on pull request #630: Log4j2 is still vulnerable and underspecified. This updates documenta…

2021-12-16 Thread GitBox
fulldecent commented on pull request #630: URL: https://github.com/apache/logging-log4j2/pull/630#issuecomment-996338330 There can be good and bad arguments for any name choice. I've made my recommendation and the final decision is above my pay grade. But I think we can agree that t

[GitHub] [logging-log4j2] mikkorantalainen commented on pull request #630: Log4j2 is still vulnerable and underspecified. This updates documenta…

2021-12-16 Thread GitBox
mikkorantalainen commented on pull request #630: URL: https://github.com/apache/logging-log4j2/pull/630#issuecomment-996316597 I think InterpretedMessage would be problematic, too, because it can be understood as "message to be interpreted in the future" or "message that has already been i

[jira] [Commented] (LOG4J2-3201) Limit the protocols JNDI can use and restrict LDAP.

2021-12-16 Thread Siri (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3201?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461134#comment-17461134 ] Siri commented on LOG4J2-3201: -- thanks a ton for 2.12.2 fix.  Any plans to do same for 2.3

[jira] [Commented] (LOGCXX-537) double mutex lock

2021-12-16 Thread Robert Middleton (Jira)
[ https://issues.apache.org/jira/browse/LOGCXX-537?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461129#comment-17461129 ] Robert Middleton commented on LOGCXX-537: - Since the recursive mutex makes things

[jira] [Comment Edited] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461118#comment-17461118 ] Jon Bristow edited comment on LOG4J2-3230 at 12/16/21, 11:52 PM: -

[jira] [Commented] (LOG4J2-3237) Log4j 1.2 bridge API hard codes protocol to TCP and host address and port to localhost:514

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461126#comment-17461126 ] Gary D. Gregory commented on LOG4J2-3237: - Your configuration file uses port 514

[jira] [Resolved] (LOG4J2-3249) Log4j 1.2 bridge for Syslog Appender defaults to port 512 instead of 514

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3249?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory resolved LOG4J2-3249. - Fix Version/s: 2.16.1 Resolution: Fixed > Log4j 1.2 bridge for Syslog Appender de

[jira] [Comment Edited] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461118#comment-17461118 ] Jon Bristow edited comment on LOG4J2-3230 at 12/16/21, 11:40 PM: -

[jira] [Commented] (LOG4J2-3249) Log4j 1.2 bridge for Syslog Appender defaults to port 512 instead of 514

2021-12-16 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461123#comment-17461123 ] ASF subversion and git services commented on LOG4J2-3249: - Commi

[jira] [Commented] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461124#comment-17461124 ] Jon Bristow commented on LOG4J2-3230: - Using my above code, 2.0 does NOT attempt to

[jira] [Created] (LOG4J2-3249) Log4j 1.2 bridge for Syslog Appender defaults to port 512 instead of 514

2021-12-16 Thread Gary D. Gregory (Jira)
Gary D. Gregory created LOG4J2-3249: --- Summary: Log4j 1.2 bridge for Syslog Appender defaults to port 512 instead of 514 Key: LOG4J2-3249 URL: https://issues.apache.org/jira/browse/LOG4J2-3249 Projec

[jira] [Comment Edited] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461118#comment-17461118 ] Jon Bristow edited comment on LOG4J2-3230 at 12/16/21, 11:16 PM: -

[jira] [Commented] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461118#comment-17461118 ] Jon Bristow commented on LOG4J2-3230: - Created a sample project that I believe repro

[jira] [Resolved] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3247?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory resolved LOG4J2-3247. - Fix Version/s: 2.16.1 Resolution: Fixed Fixed in git {{release-2.x}} branch. > P

[jira] [Commented] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461113#comment-17461113 ] ASF subversion and git services commented on LOG4J2-3247: - Commi

[jira] [Updated] (LOG4J2-3230) Certain strings can cause infinite recursion

2021-12-16 Thread Jon Bristow (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3230?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Jon Bristow updated LOG4J2-3230: Attachment: sample.tar.gz > Certain strings can cause infinite recursion > ---

[GitHub] [logging-log4j2] sullis opened a new pull request #635: remove Maven cache action

2021-12-16 Thread GitBox
sullis opened a new pull request #635: URL: https://github.com/apache/logging-log4j2/pull/635 The cache action is no longer needed. We already have the 'cache' property enabled in setup-java. -- This is an automated message from the Apache Git Service. To respond to the message, p

[jira] [Updated] (LOG4J2-3248) Error while appending a message after Stopping/Restarting KafkaAppender

2021-12-16 Thread Bhavesh Patel (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3248?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bhavesh Patel updated LOG4J2-3248: -- Component/s: Appenders > Error while appending a message after Stopping/Restarting KafkaAppend

[jira] [Updated] (LOG4J2-3248) Error while appending a message after Stopping/Restarting KafkaAppender

2021-12-16 Thread Bhavesh Patel (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3248?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bhavesh Patel updated LOG4J2-3248: -- Affects Version/s: 2.16.0 > Error while appending a message after Stopping/Restarting KafkaApp

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461074#comment-17461074 ] Matt Sicker commented on LOG4J2-3221: - We've updated the CVE to mention that this _o

[jira] [Updated] (LOG4J2-3248) Error while appending a message after Stopping/Restarting KafkaAppender

2021-12-16 Thread Bhavesh Patel (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3248?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bhavesh Patel updated LOG4J2-3248: -- Description: As a part of this commit,  [https://github.com/apache/logging-log4j2/commit/97db5

[jira] [Commented] (LOG4J2-3244) version 2.16 affected by CVE-2021-4104

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461071#comment-17461071 ] Matt Sicker commented on LOG4J2-3244: - This was fixed in 2.12.2 at least. If you're

[jira] [Created] (LOG4J2-3248) Error while appending a message after Stopping/Restarting KafkaAppender

2021-12-16 Thread Bhavesh Patel (Jira)
Bhavesh Patel created LOG4J2-3248: - Summary: Error while appending a message after Stopping/Restarting KafkaAppender Key: LOG4J2-3248 URL: https://issues.apache.org/jira/browse/LOG4J2-3248 Project: Lo

[jira] [Updated] (LOG4J2-3244) version 2.16 affected by CVE-2021-4104

2021-12-16 Thread Alysson Bruno (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3244?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alysson Bruno updated LOG4J2-3244: -- Issue Type: Story (was: Bug) > version 2.16 affected by CVE-2021-4104 > -

[jira] [Updated] (LOG4J2-3244) version 2.16 affected by CVE-2021-4104

2021-12-16 Thread Alysson Bruno (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3244?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alysson Bruno updated LOG4J2-3244: -- Labels: security (was: ) > version 2.16 affected by CVE-2021-4104 > -

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Corey Puffalt (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461056#comment-17461056 ] Corey Puffalt commented on LOG4J2-3221: --- Can anyone confirm whether using log4j-to

[jira] [Comment Edited] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Corey Puffalt (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461056#comment-17461056 ] Corey Puffalt edited comment on LOG4J2-3221 at 12/16/21, 9:48 PM:

[jira] [Comment Edited] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461049#comment-17461049 ] Gary D. Gregory edited comment on LOG4J2-3247 at 12/16/21, 9:28 PM: --

[jira] [Commented] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461049#comment-17461049 ] Gary D. Gregory commented on LOG4J2-3247: - May you please post your stack trace?

[jira] [Closed] (LOG4J2-3245) log4j-core-2.0-beta9.jar CVE-2021-44228 vulnerability

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3245?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Gary D. Gregory closed LOG4J2-3245. --- Fix Version/s: 2.16.0 Resolution: Fixed > log4j-core-2.0-beta9.jar CVE-2021-44228 vul

[jira] [Commented] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Gary D. Gregory (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461020#comment-17461020 ] Gary D. Gregory commented on LOG4J2-3243: - Hi [~lordjaxom]  A) We do not suppor

[GitHub] [logging-log4j2] mdolinin closed pull request #634: Remove JndiLookup class and all related tests to prevent potential security issues

2021-12-16 Thread GitBox
mdolinin closed pull request #634: URL: https://github.com/apache/logging-log4j2/pull/634 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifica

[jira] [Updated] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread Jira
[ https://issues.apache.org/jira/browse/LOG4J2-3247?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Fábio Constantino updated LOG4J2-3247: -- Description: When parsing appender filters configured in the properties file for examp

[GitHub] [logging-log4j2] mdolinin opened a new pull request #634: Remove JndiLookup class and all related tests to prevent potential security issues

2021-12-16 Thread GitBox
mdolinin opened a new pull request #634: URL: https://github.com/apache/logging-log4j2/pull/634 … -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: n

[jira] [Created] (LOG4J2-3247) PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters

2021-12-16 Thread Jira
Fábio Constantino created LOG4J2-3247: - Summary: PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters Key: LOG4J2-3247 URL: https://issues.apache.org/jira/browse/LOG4J2-3247

[jira] [Closed] (LOG4J2-3246) We found Log 4j 1.x version vulnerability in kprdtax01 VM. Need your help to fix this

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3246?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Matt Sicker closed LOG4J2-3246. --- Resolution: Invalid This is the Jira for Log4j 2.x. I have no idea what that VM is you're speaking

[GitHub] [logging-log4j-site] ron-murhammer opened a new pull request #6: Update Vulnerabilities Page for 2.12.2 Release

2021-12-16 Thread GitBox
ron-murhammer opened a new pull request #6: URL: https://github.com/apache/logging-log4j-site/pull/6 Remove reference to release 2.12.2 being a work in progress -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL

[jira] [Created] (LOG4J2-3246) We found Log 4j 1.x version vulnerability in kprdtax01 VM. Need your help to fix this

2021-12-16 Thread Ujwal (Jira)
Ujwal created LOG4J2-3246: - Summary: We found Log 4j 1.x version vulnerability in kprdtax01 VM. Need your help to fix this Key: LOG4J2-3246 URL: https://issues.apache.org/jira/browse/LOG4J2-3246 Project: Log4

[jira] [Created] (LOG4J2-3245) log4j-core-2.0-beta9.jar CVE-2021-44228 vulnerability

2021-12-16 Thread Chaitanya (Jira)
Chaitanya created LOG4J2-3245: - Summary: log4j-core-2.0-beta9.jar CVE-2021-44228 vulnerability Key: LOG4J2-3245 URL: https://issues.apache.org/jira/browse/LOG4J2-3245 Project: Log4j 2 Issue Type

[jira] [Comment Edited] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Sascha Volkenandt (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460890#comment-17460890 ] Sascha Volkenandt edited comment on LOG4J2-3243 at 12/16/21, 5:16 PM:

[jira] [Commented] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Sascha Volkenandt (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460890#comment-17460890 ] Sascha Volkenandt commented on LOG4J2-3243: --- When debugging, I got into Config

[jira] [Commented] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460875#comment-17460875 ] Matt Sicker commented on LOG4J2-3243: - The log4j2 system properties parser accepts p

[jira] [Resolved] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Matt Sicker resolved LOG4J2-3221. - Resolution: Fixed > JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0 > -

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Matt Sicker (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460869#comment-17460869 ] Matt Sicker commented on LOG4J2-3221: - [~quaff]: correct. The security page needs to

[GitHub] [logging-log4j2] garydgregory commented on a change in pull request #630: Log4j2 is still vulnerable and underspecified. This updates documenta…

2021-12-16 Thread GitBox
garydgregory commented on a change in pull request #630: URL: https://github.com/apache/logging-log4j2/pull/630#discussion_r770718080 ## File path: log4j-api/src/main/java/org/apache/logging/log4j/Logger.java ## @@ -137,7 +137,7 @@ * Logs a message CharSequence with the {

[jira] [Updated] (LOG4J2-3244) version 2.16 affected by CVE-2021-4104

2021-12-16 Thread Alysson Bruno (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3244?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alysson Bruno updated LOG4J2-3244: -- Description: Hi Folk, I'm investigating replace my log4j1 to log4j 2.16 because threat found

[jira] [Created] (LOG4J2-3244) version 2.16 affected by CVE-2021-4104

2021-12-16 Thread Alysson Bruno (Jira)
Alysson Bruno created LOG4J2-3244: - Summary: version 2.16 affected by CVE-2021-4104 Key: LOG4J2-3244 URL: https://issues.apache.org/jira/browse/LOG4J2-3244 Project: Log4j 2 Issue Type: Bug

[jira] [Created] (LOG4J2-3243) Property log4j.configurationFile incorrectly documented, log4j.configuration missing

2021-12-16 Thread Sascha Volkenandt (Jira)
Sascha Volkenandt created LOG4J2-3243: - Summary: Property log4j.configurationFile incorrectly documented, log4j.configuration missing Key: LOG4J2-3243 URL: https://issues.apache.org/jira/browse/LOG4J2-3243

[GitHub] [logging-log4j-site] sebbASF commented on pull request #5: Fix 2.12.2 links again

2021-12-16 Thread GitBox
sebbASF commented on pull request #5: URL: https://github.com/apache/logging-log4j-site/pull/5#issuecomment-995819946 I would also have submitted a patch for the source that creates the page, but I could not work out where that is. It also needs to be applied to the production site...

[GitHub] [logging-log4j-site] garydgregory commented on pull request #5: Fix 2.12.2 links again

2021-12-16 Thread GitBox
garydgregory commented on pull request #5: URL: https://github.com/apache/logging-log4j-site/pull/5#issuecomment-995802083 TY @sebbASF ! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the speci

[GitHub] [logging-log4j-site] garydgregory merged pull request #5: Fix 2.12.2 links again

2021-12-16 Thread GitBox
garydgregory merged pull request #5: URL: https://github.com/apache/logging-log4j-site/pull/5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: noti

[GitHub] [logging-log4j-site] garydgregory commented on pull request #4: Yet more 2.3 fixes

2021-12-16 Thread GitBox
garydgregory commented on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995798380 I generated the 2.12.2 site from sources, it never existed before. The 2.12.1 folder was hand edited for 2.12.2 so we need to clean all that up, but at least 2.3 i

[GitHub] [logging-log4cxx] rm5248 commented on a change in pull request #83: Fix constructions of sed filter in corner cases

2021-12-16 Thread GitBox
rm5248 commented on a change in pull request #83: URL: https://github.com/apache/logging-log4cxx/pull/83#discussion_r770518357 ## File path: src/test/cpp/util/transformer.cpp ## @@ -116,14 +116,29 @@ void Transformer::createSedCommandFile(const std::string& regexName,

[jira] [Commented] (LOG4J2-3192) log4j2.properties: monitorInterval has no effect since 2.13.2

2021-12-16 Thread Simon Ziller (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460667#comment-17460667 ] Simon Ziller commented on LOG4J2-3192: -- Some additional information: With system pr

[GitHub] [logging-log4j2] SkySwimmer closed pull request #633: [possibly redundant] Completely disable JNDI in Interpolator.java, in the hope to patch CVE-2021-44228

2021-12-16 Thread GitBox
SkySwimmer closed pull request #633: URL: https://github.com/apache/logging-log4j2/pull/633 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifi

[GitHub] [logging-log4j-site] sebbASF opened a new pull request #5: Fix 2.3 links again

2021-12-16 Thread GitBox
sebbASF opened a new pull request #5: URL: https://github.com/apache/logging-log4j-site/pull/5 Also fix a couple of hash names -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific commen

[GitHub] [logging-log4j2] SkySwimmer commented on pull request #633: [possibly redundant] Completely disable JNDI in Interpolator.java, in the hope to patch CVE-2021-44228

2021-12-16 Thread GitBox
SkySwimmer commented on pull request #633: URL: https://github.com/apache/logging-log4j2/pull/633#issuecomment-995756888 Sorry about the capitalization of the title -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the

[GitHub] [logging-log4j-site] sebbASF commented on pull request #4: Yet more 2.3 fixes

2021-12-16 Thread GitBox
sebbASF commented on pull request #4: URL: https://github.com/apache/logging-log4j-site/pull/4#issuecomment-995744256 Unfortunately the new 2.12.2 download page: https://logging.apache.org/log4j/log4j-2.12.2/download.html has restored all the old links, so there is no access to version

[GitHub] [logging-log4j2] SkySwimmer edited a comment on pull request #633: Completely disable JNDI in Interpolator.java, in the hope to patch CVE-2021-44228

2021-12-16 Thread GitBox
SkySwimmer edited a comment on pull request #633: URL: https://github.com/apache/logging-log4j2/pull/633#issuecomment-995739315 Sorry if this patch is redundant, i wasn't sure it was patched already -- This is an automated message from the Apache Git Service. To respond to the message, pl

[GitHub] [logging-log4j2] SkySwimmer commented on pull request #633: Completely disable JNDI in Interpolator.java, in the hope to patch CVE-2021-44228

2021-12-16 Thread GitBox
SkySwimmer commented on pull request #633: URL: https://github.com/apache/logging-log4j2/pull/633#issuecomment-995739315 Sorry if this patch is redundant, i wasn't sure it was patched anymore -- This is an automated message from the Apache Git Service. To respond to the message, please lo

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Lloyd Fernandes (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460636#comment-17460636 ] Lloyd Fernandes commented on LOG4J2-3221: - Just a feedback on the note: "{_}Note

[GitHub] [logging-log4j2] SkySwimmer opened a new pull request #633: Completely disable JNDI, to patch CVE-2021-44228

2021-12-16 Thread GitBox
SkySwimmer opened a new pull request #633: URL: https://github.com/apache/logging-log4j2/pull/633 I have completely removed JNDI from the Interpolator, so that the CVE-2021-44228 exploit will not be able to call LDAP. ```java // Interpolator.java (org.apache.logging.log4j.core.loo

[jira] [Commented] (LOG4J2-3217) Configurator.initialize(String,ClassLoader,URI) throws NPE

2021-12-16 Thread Jira
[ https://issues.apache.org/jira/browse/LOG4J2-3217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460627#comment-17460627 ] Étienne Miret commented on LOG4J2-3217: --- [~vy] yes, of course. But when I tried to

[GitHub] [logging-log4j2] zhuyou1234 opened a new pull request #632: Update Required.java

2021-12-16 Thread GitBox
zhuyou1234 opened a new pull request #632: URL: https://github.com/apache/logging-log4j2/pull/632 tip message is not accurate。required check null and empty -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above

[GitHub] [logging-log4j2] zhuyou1234 opened a new pull request #631: async logger name can be empty。for compatible old version

2021-12-16 Thread GitBox
zhuyou1234 opened a new pull request #631: URL: https://github.com/apache/logging-log4j2/pull/631 should be allowed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comm

[jira] [Commented] (LOG4J2-3221) JNDI lookups in layout (not message patterns) enabled in Log4j2 < 2.16.0

2021-12-16 Thread Lloyd Fernandes (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17460525#comment-17460525 ] Lloyd Fernandes commented on LOG4J2-3221: - [~vy]  i am new to the Jira world of

[CI][UNSTABLE] Logging/log4j/release-2.x#466 has test failures

2021-12-16 Thread Mr. Jenkins
BUILD UNSTABLE Build URL https://ci-builds.apache.org/job/Logging/job/log4j/job/release-2.x/466/ Project: release-2.x Date of build: Thu, 16 Dec 2021 07:24:22 + Build duration: 1 hr 10 min and counting JUnit Tests Name: (root) Failed: 0 test(s),

[jira] [Resolved] (LOG4NET-680) .NET 6 threadpool thread name is not helpful in %thread/%t field

2021-12-16 Thread Davyd McColl (Jira)
[ https://issues.apache.org/jira/browse/LOG4NET-680?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Davyd McColl resolved LOG4NET-680. -- Fix Version/s: 2.0.14 Resolution: Fixed PR is merged, should appear in 2.0.14 release

[jira] [Resolved] (LOG4NET-671) LoggingEvent does not correctly dispose WindowsIdentity

2021-12-16 Thread Davyd McColl (Jira)
[ https://issues.apache.org/jira/browse/LOG4NET-671?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Davyd McColl resolved LOG4NET-671. -- Fix Version/s: 2.0.14 Resolution: Fixed PR is merged, should appear in 2.0.14 release

[jira] [Closed] (LOG4J2-3214) Update security page text for CVE-2021-44228

2021-12-16 Thread Remko Popma (Jira)
[ https://issues.apache.org/jira/browse/LOG4J2-3214?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Remko Popma closed LOG4J2-3214. --- Resolution: Fixed > Update security page text for CVE-2021-44228 > -

[GitHub] [logging-log4j2] quaff commented on pull request #617: LOG4J2-3204 - Correct SpringLookup package name in Interpolator

2021-12-16 Thread GitBox
quaff commented on pull request #617: URL: https://github.com/apache/logging-log4j2/pull/617#issuecomment-995530594 This fix works. Before this commit `${spring:spring.application.name:-unknown}` will always be `unknown` even `spring.application.name` present. -- This is an automated