[GitHub] [logging-log4j2] TopStreamsNet edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
TopStreamsNet edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301 @ceki @remkop - it is not exactly true that it doesn't suffer from lookup issue though. If you look at how jndi works in 1.x you will find that there are

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991730650 Thank you for the detailed references. **If the attacker can modify the config file on some system S, then S can be assumed to be already penetrated to a large e

[GitHub] [logging-log4j2] TopStreamsNet commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
TopStreamsNet commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991739074 > If the attacker can modify log4j.properties (log4j 1.x), she she does not need to download malicious code, she can just as easily place malicious class files in the

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991744851 How about a man in the middle? Are the LDAP URLs validated? TLS certificate? -- This is an automated message from the Apache Git Service. To respond to the message, please log

[GitHub] [logging-log4j2] fyhao commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
fyhao commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991747594 > Also, if this matters to you so much, why not show it with a donation to the Apache Software Foundation https://www.apache.org/foundation/contributing.html or this project'

[GitHub] [logging-log4j2] fyhao removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
fyhao removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991747594 > Also, if this matters to you so much, why not show it with a donation to the Apache Software Foundation https://www.apache.org/foundation/contributing.html or this

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991730650 Thank you for the detailed references. **If the attacker can modify the config file on some system S, then S can be assumed to be already penetrated to a large e

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991730650 Thank you for the detailed references. **If the attacker can modify the config file on some system S, then S can be assumed to have been already penetrated to a

[GitHub] [logging-log4j2] ceki commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991754366 > I can't completely agree with this statement as I can see a whole number of use-cases where users can legitimately amend configuration or it's part for customization reasons

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991754874 Handing over control of an application's logging system to untrusted users is already handing over the keys. -- This is an automated message from the Apache Git Service. To r

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991754366 > I can't completely agree with this statement as I can see a whole number of use-cases where users can legitimately amend configuration or it's part for customization

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991754366 > I can't completely agree with this statement as I can see a whole number of use-cases where users can legitimately amend configuration or it's part for customization

[GitHub] [logging-log4j-scala] pjfanning commented on pull request #5: upgrade dependencies to partially suit scala 3 build

2021-12-11 Thread GitBox
pjfanning commented on pull request #5: URL: https://github.com/apache/logging-log4j-scala/pull/5#issuecomment-991768025 Thanks for the comments @jvz - I've only covered a fraction of the functions so far - I'll keep tipping away but it could take a while. Scala macros are not something I'

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991380319 When there are literally millions of log4j 1.x users out there, can you stop toying around? There is no lookup expansion in log4j 1.x and it does not suffer from

[GitHub] [logging-log4j2] ceki commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991796194 > > When there are literally millions of log4j 1.x users out there, can you stop toying around? > > There is no lookup expansion in log4j 1.x and it does not suffer from [C

[GitHub] [logging-log4j2] ceki removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991796194 > > When there are literally millions of log4j 1.x users out there, can you stop toying around? > > There is no lookup expansion in log4j 1.x and it does not suffer

[GitHub] [logging-log4j2] ceki commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991799399 > Handing over control of an application's logging system to untrusted users is already handing over the keys. Yes, that is probably in many cases. However, one can imag

[GitHub] [logging-log4j-scala] pjfanning commented on pull request #5: upgrade dependencies to partially suit scala 3 build

2021-12-11 Thread GitBox
pjfanning commented on pull request #5: URL: https://github.com/apache/logging-log4j-scala/pull/5#issuecomment-991800432 @jvz I'm wondering about some logger methods and why we don't just call the delegate directly - that using the macro code doesn't seem to add anything in some cases.

[GitHub] [logging-log4j2] jsoref commented on a change in pull request #613: Spelling

2021-12-11 Thread GitBox
jsoref commented on a change in pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#discussion_r767203869 ## File path: src/site/asciidoc/manual/appenders.adoc ## @@ -1270,12 +1270,12 @@ new `` configuration element. [cols=",,,",options="header",] |=

[GitHub] [logging-log4cxx] rm5248 opened a new pull request #82: LOGCXX-537 avoid deadlock if socket fails

2021-12-11 Thread GitBox
rm5248 opened a new pull request #82: URL: https://github.com/apache/logging-log4cxx/pull/82 Alternative to PR #78 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsu

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 > Hi @rgoers, is log4j 1.x vulnerable? Hi @yuezk, as far as I can tell, log4j 1.x does not support lookups. ~~I also could not find any other reference to JNDI

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990661374 > @remkop Which description is correct ? @linux-ops You are asking me? Well, in my totally objective, completely unbiased opinion, there is no doubt that my com

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990758663 > @remkop , thanks for your reply. Just want to make it more clear, because many people reach this issue mainly for the "JNDI lookup" CVE, so, for log4j 1.x, although

[GitHub] [logging-log4j2] rgoers commented on pull request #613: Spelling

2021-12-11 Thread GitBox
rgoers commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991827829 @pjfanning That is one of my favorite words to misspell. :-) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub

[GitHub] [logging-log4j2] jsoref commented on pull request #613: Spelling

2021-12-11 Thread GitBox
jsoref commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991828510 I don't care about credit. I make PRs to improve codebases. Feel free to cherry-pick whichever pieces/ideas you like (or reimplement). I've also made a corresponding s

[GitHub] [logging-log4cxx] ams-tschoening commented on pull request #79: Fix parallel execution of the testsuite

2021-12-11 Thread GitBox
ams-tschoening commented on pull request #79: URL: https://github.com/apache/logging-log4cxx/pull/79#issuecomment-991649922 Looks like you have simply missed to change `src/test/resources/input/patternLayout13.properties`? I find all the other files changed, but not this one. -- This is

[GitHub] [logging-log4j2] mdpollard commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-11 Thread GitBox
mdpollard commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r767031109 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2

[GitHub] [logging-log4cxx] ams-tschoening removed a comment on pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
ams-tschoening removed a comment on pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81#issuecomment-991705032 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific co

[GitHub] [logging-log4j2] jvz commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
jvz commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991233294 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubsc

[GitHub] [logging-log4j2] albertinix commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
albertinix commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991225381 Does anyone know if removing the `JndiLookup` class is enough? On the [Apache Log4j2 page](https://logging.apache.org/log4j/2.x/) it's stated to: >Remove th

[GitHub] [logging-log4j2] Marcono1234 commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
Marcono1234 commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991396409 The latest Java versions are most likely still vulnerable to RCE. While they prevent loading classes from remote sources by default (`trustURLCodebase` property mention

[GitHub] [logging-log4j2] Marcono1234 edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
Marcono1234 edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991396409 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comme

[GitHub] [logging-log4j2] pjfanning commented on pull request #613: Spelling

2021-12-11 Thread GitBox
pjfanning commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991224174 One typo that I noticed earlier was 'primative' appearing in a few places in one of the PRs related to the recent CVE issue. (https://github.com/apache/logging-log4j2/pu

[GitHub] [logging-log4cxx] rm5248 commented on pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
rm5248 commented on pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81#issuecomment-991664058 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsub

[GitHub] [logging-log4j2] Firminator commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
Firminator commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991418303 > Also, if this matters to you so much, why not show it with a donation to ... or this project's main contributor https://github.com/sponsors/rgoers ? Case of http

[GitHub] [logging-log4cxx] coldtobi closed pull request #79: Fix parallel execution of the testsuite

2021-12-11 Thread GitBox
coldtobi closed pull request #79: URL: https://github.com/apache/logging-log4cxx/pull/79 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificat

[GitHub] [logging-log4j2] philipwhiuk commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
philipwhiuk commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991305906 > https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/net/JMSAppender.html This presumably requires configuring the appending though, so a simple FileA

[GitHub] [logging-log4j2] ceki removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991796194 > > When there are literally millions of log4j 1.x users out there, can you stop toying around? > > There is no lookup expansion in log4j 1.x and it does not suffer

[GitHub] [logging-log4cxx] coldtobi edited a comment on pull request #79: Fix parallel execution of the testsuite

2021-12-11 Thread GitBox
coldtobi edited a comment on pull request #79: URL: https://github.com/apache/logging-log4cxx/pull/79#issuecomment-991687037 > Looks like you have simply missed to change `src/test/resources/input/patternLayout13.properties`? I find all the other files changed, but not this one. Goo

[GitHub] [logging-log4j2] TopStreamsNet edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
TopStreamsNet edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific com

[GitHub] [logging-log4cxx] coldtobi edited a comment on pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
coldtobi edited a comment on pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81#issuecomment-991684540 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

[GitHub] [logging-log4cxx] coldtobi closed pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
coldtobi closed pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificat

[GitHub] [logging-log4j2] remkop edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
remkop edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990661374 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991387493 > When there are literally millions of log4j 1.x users out there, can you stop toying around? > > There is no lookup expansion in log4j 1.x and it does not suffer from

[GitHub] [logging-log4j2] vy commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
vy commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991241208 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscr

[GitHub] [logging-log4cxx] coldtobi commented on pull request #79: Fix parallel execution of the testsuite

2021-12-11 Thread GitBox
coldtobi commented on pull request #79: URL: https://github.com/apache/logging-log4cxx/pull/79#issuecomment-991619447 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To uns

[GitHub] [logging-log4cxx] coldtobi commented on pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
coldtobi commented on pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81#issuecomment-991684540 I'm not sure about what changes requested: - The suggestion from @ams-tschoening for formatting the gitattributes file - rm5248's comment I thought that the pur

[GitHub] [logging-log4cxx] rm5248 merged pull request #76: Update log4cxx.h.in

2021-12-11 Thread GitBox
rm5248 merged pull request #76: URL: https://github.com/apache/logging-log4cxx/pull/76 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificatio

[GitHub] [logging-log4cxx] rm5248 merged pull request #77: LOGCXX-536 Use CMAKE_INSTALL_LIBDIR instead CMAKE_INSTALL_DATAROOTDIR…

2021-12-11 Thread GitBox
rm5248 merged pull request #77: URL: https://github.com/apache/logging-log4cxx/pull/77 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificatio

[GitHub] [logging-log4j2] qqchaozai commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
qqchaozai commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991724441 We build class like this: package org.apache.logging.log4j.core.lookup; public class JndiLookup {}

[GitHub] [logging-log4j2] philipwhiuk edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
philipwhiuk edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991305906 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comme

[GitHub] [logging-log4j2] jsoref commented on pull request #613: Spelling

2021-12-11 Thread GitBox
jsoref commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991828510 I don't care about credit. I make PRs to improve codebases. Feel free to cherry-pick whichever pieces/ideas you like (or reimplement). I've also made a corresponding s

[GitHub] [logging-log4cxx] ams-tschoening commented on pull request #81: Don't convert CRLF, git

2021-12-11 Thread GitBox
ams-tschoening commented on pull request #81: URL: https://github.com/apache/logging-log4cxx/pull/81#issuecomment-991653650 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

[GitHub] [logging-log4j2] fyhao removed a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
fyhao removed a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991747594 > Also, if this matters to you so much, why not show it with a donation to the Apache Software Foundation https://www.apache.org/foundation/contributing.html or this

[GitHub] [logging-log4j2] mosajjal commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
mosajjal commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991246265 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To un

[GitHub] [logging-log4j2] lawndoc edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
lawndoc edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991297822 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

[GitHub] [logging-log4j2] ahahu commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ahahu commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991354707 I'd also like to stress, that it is not sufficient to mitigate this vulnerability by using a JRE/JDK version which prevents the RCE, nor should you rely solely on your firewa

[GitHub] [logging-log4j2] TopStreamsNet commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
TopStreamsNet commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

[GitHub] [logging-log4j-scala] pjfanning commented on pull request #5: upgrade dependencies to partially suit scala 3 build

2021-12-11 Thread GitBox
pjfanning commented on pull request #5: URL: https://github.com/apache/logging-log4j-scala/pull/5#issuecomment-991768025 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To

[GitHub] [logging-log4j2] lawndoc commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
lawndoc commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991297822 I think this [fix has been bypassed](https://twitter.com/stereotype32/status/1469313856229228544?s=20) and that the latest release is still vulnerable... Haven't verified t

[GitHub] [logging-log4j2] garydgregory commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
garydgregory commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991210213 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. T

[GitHub] [logging-log4j2] fyhao commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
fyhao commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991747594 > Also, if this matters to you so much, why not show it with a donation to the Apache Software Foundation https://www.apache.org/foundation/contributing.html or this project'

[GitHub] [logging-log4j2] jsoref commented on a change in pull request #613: Spelling

2021-12-11 Thread GitBox
jsoref commented on a change in pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#discussion_r767203869 ## File path: src/site/asciidoc/manual/appenders.adoc ## @@ -1270,12 +1270,12 @@ new `` configuration element. [cols=",,,",options="header",] |=

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991380319 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To

[GitHub] [logging-log4j2] TiloGit commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
TiloGit commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991215492 > > Can't find much info about it. > > grep-ing through the source code for jdk-11.0.1 we get `src/java.naming/com/sun/jndi/ldap/VersionHelper.java: PrivilegedAction

[GitHub] [logging-log4j2] ceki commented on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
ceki commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991380319 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubs

[GitHub] [logging-log4j2] rgoers commented on pull request #613: Spelling

2021-12-11 Thread GitBox
rgoers commented on pull request #613: URL: https://github.com/apache/logging-log4j2/pull/613#issuecomment-991827829 @pjfanning That is one of my favorite words to misspell. :-) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub

[GitHub] [logging-log4cxx] rm5248 merged pull request #80: Use packaged liblog4j-1.2

2021-12-11 Thread GitBox
rm5248 merged pull request #80: URL: https://github.com/apache/logging-log4cxx/pull/80 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificatio

[GitHub] [logging-log4j2] albertinix edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-11 Thread GitBox
albertinix edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991225381 (re: the fix for versions <= 2.14.1) Does anyone know if removing the `JndiLookup` class is enough? On the [Apache Log4j2 page](https://logging.apache

[GitHub] [logging-log4j2] GSPP commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
GSPP commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991863991 With this fix, can a log message still cause any side-effect at all? If yes, that seems rather dangerous since log messages are often attacker-controlled. -- This is an auto

[GitHub] [logging-log4j2] carterkozak commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
carterkozak commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991896511 @GSPP that was resolved in 2.15 via https://github.com/apache/logging-log4j2/commit/001aaada7dab82c3c09cde5f8e14245dc9d8b454 -- This is an automated message from the

[GitHub] [logging-log4j2] moparthisai commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
moparthisai commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991907877 We are using apache solr 8.6 version and we wan to update the version of log4j2 on your runtime classpath ( Due to Apache Solr affected by Apache Log4J CVE-2021-44228)

[GitHub] [logging-log4j2] vy commented on a change in pull request #607: LOG4J2-3198: Log4j2 no longer formats lookups in messages by default

2021-12-12 Thread GitBox
vy commented on a change in pull request #607: URL: https://github.com/apache/logging-log4j2/pull/607#discussion_r767311920 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1455,9 +1455,9 @@ WARN [main]: Message 2 -

[GitHub] [logging-log4j2] jyemin opened a new pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
jyemin opened a new pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618 Check that the class name in the `javaClassName` attribute exactly matches the class name in the `javaSerializedData` attribute. Background: The new documentation states the follow

[GitHub] [logging-log4j2] garydgregory commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
garydgregory commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-991969321 You'll need a test that fails without the main changes to prove this actually works, please see our existing tests for inspiration. You might need to use mocking to pr

[GitHub] [logging-log4j2] jyemin commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
jyemin commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-991969990 > You'll need a test that fails without the main changes to prove this actually works I agree, but I don't see a way to mock this. I'd appreciate any ideas, so feel

[GitHub] [logging-log4j2] garydgregory commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
garydgregory commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-991972061 Then perhaps consider refactoring the code in a way that makes it testable. Otherwise, this is just one commit away from a regression :-( -- This is an automated mes

[GitHub] [logging-log4j2] ceki edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
ceki edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991799399 > Handing over control of an application's logging system to untrusted users is already handing over the keys. Yes, that is probably true in many cases. However,

[GitHub] [logging-log4j2] jschauma opened a new pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
jschauma opened a new pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620 It is my understanding that as of 2.15.0 `formatMsgNoLookups=true` by default; this doc still showed that as "false". -- This is an automated message from the Apache Git Service. To respond to

[GitHub] [logging-log4j2] tony-- commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
tony-- commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991982037 @zhangyoufu @remkop the suggestion to > remove org/apache/logging/log4j/core/lookup/JndiLookup.class from log4j-core-*.jar as a workaround is called out as an opt

[GitHub] [logging-log4j2] garydgregory commented on pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
garydgregory commented on pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620#issuecomment-991982161 Hi @jschauma The site is built from the release-2.x branch. The master branch is for work toward 3.0. -- This is an automated message from the Apache Git Service

[GitHub] [logging-log4j2] remkop commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
remkop commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991982446 > @zhangyoufu @remkop the suggestion to > > > remove org/apache/logging/log4j/core/lookup/JndiLookup.class from log4j-core-*.jar as a workaround > > is called o

[GitHub] [logging-log4j2] jschauma commented on pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
jschauma commented on pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620#issuecomment-991982712 Should this change be reflected in both branches, or is the default value of `formatMsgNoLookups` going to be `false` again in the 3.0 release? Do you want me to sub

[GitHub] [logging-log4j2] garydgregory commented on pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
garydgregory commented on pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620#issuecomment-991983167 Yes but... things are in flux ATM as you can imagine and the team is still dealing with the aftermath of this weekend's activity. I don't want you to waste your time i

[GitHub] [logging-log4j2] jschauma commented on pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
jschauma commented on pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620#issuecomment-991983856 Sure thing. Just wanted to make sure this doesn't get dropped or lost. Happy to leave this PR dangling or close it out if you think it's being handled already. -- This

[GitHub] [logging-log4j2] rgoers commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
rgoers commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-991985075 This shouldn't be too hard to test. We just need to store the appropriate attributes in the test LDAP to simulate an attack. Let me check this out and see if I can help wit

[GitHub] [logging-log4j2] jyemin commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
jyemin commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-992009288 Figuring out how to test this is definitely worthwhile, but I think I'm going to have to reconsider the approach. I had a closer look at `ObjectInputStream`, and realized t

[GitHub] [logging-log4j2] jambestwick commented on pull request #620: Config defaults to formatMsgNoLookups=true

2021-12-12 Thread GitBox
jambestwick commented on pull request #620: URL: https://github.com/apache/logging-log4j2/pull/620#issuecomment-992018225 not well -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific co

[GitHub] [logging-log4j2] jambestwick commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
jambestwick commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-992020861 @jyemin I agree with you ,need to test it -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the U

[GitHub] [logging-log4j2] rgoers closed pull request #621: Remove msg lookup

2021-12-12 Thread GitBox
rgoers closed pull request #621: URL: https://github.com/apache/logging-log4j2/pull/621 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificati

[GitHub] [logging-log4j2] garydgregory commented on pull request #621: Remove msg lookup

2021-12-12 Thread GitBox
garydgregory commented on pull request #621: URL: https://github.com/apache/logging-log4j2/pull/621#issuecomment-992031700 1266 commits in this PR? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go t

[GitHub] [logging-log4j2] ecki opened a new pull request #622: Cleanup of unused constant and double IsIs prefix

2021-12-12 Thread GitBox
ecki opened a new pull request #622: URL: https://github.com/apache/logging-log4j2/pull/622 Trivial change -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe,

[GitHub] [logging-log4j2] garydgregory commented on pull request #622: Cleanup of unused constant and double IsIs prefix

2021-12-12 Thread GitBox
garydgregory commented on pull request #622: URL: https://github.com/apache/logging-log4j2/pull/622#issuecomment-992059769 This should be for the release-2.x branch as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and

[GitHub] [logging-log4j2] jyemin commented on pull request #618: Check javaClassName before JNDI lookup

2021-12-12 Thread GitBox
jyemin commented on pull request #618: URL: https://github.com/apache/logging-log4j2/pull/618#issuecomment-992063803 I refactored and reimplemented using a hopefully more reliable design. The bulk of the code has been extracted into a helper class and unit tested. The conditional in Jndi

[GitHub] [logging-log4j2] carterkozak commented on a change in pull request #623: Remove Messge Lookups

2021-12-12 Thread GitBox
carterkozak commented on a change in pull request #623: URL: https://github.com/apache/logging-log4j2/pull/623#discussion_r767392960 ## File path: log4j-core/src/test/java/org/apache/logging/log4j/core/pattern/MessagePatternConverterTest.java ## @@ -121,7 +121,7 @@ public void

[GitHub] [logging-log4j2] remkop commented on a change in pull request #623: Remove Messge Lookups

2021-12-12 Thread GitBox
remkop commented on a change in pull request #623: URL: https://github.com/apache/logging-log4j2/pull/623#discussion_r767411342 ## File path: src/site/xdoc/manual/layouts.xml.vm ## @@ -1497,18 +1497,6 @@ WARN [main]: Message 2 The call site can look like thi

[GitHub] [logging-log4j2] rgoers commented on a change in pull request #623: LOG4J2-3211 - Remove Messge Lookups

2021-12-12 Thread GitBox
rgoers commented on a change in pull request #623: URL: https://github.com/apache/logging-log4j2/pull/623#discussion_r767417316 ## File path: log4j-core/src/test/java/org/apache/logging/log4j/core/pattern/MessagePatternConverterTest.java ## @@ -121,7 +121,7 @@ public void test

[GitHub] [logging-log4j2] rgoers merged pull request #623: LOG4J2-3211 - Remove Messge Lookups

2021-12-12 Thread GitBox
rgoers merged pull request #623: URL: https://github.com/apache/logging-log4j2/pull/623 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notificati

[GitHub] [logging-log4j2] ancms2600 commented on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
ancms2600 commented on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-992140388 > If you look at how jndi works in 1.x you will find that there are two places where lookups are done - that is JMSAppender.java:207 and JMSAppender.java:222 For t

[GitHub] [logging-log4j2] ancms2600 edited a comment on pull request #608: Restrict LDAP access via JNDI

2021-12-12 Thread GitBox
ancms2600 edited a comment on pull request #608: URL: https://github.com/apache/logging-log4j2/pull/608#issuecomment-992140388 > If you look at how jndi works in 1.x you will find that there are two places where lookups are done - that is JMSAppender.java:207 and JMSAppender.java:222

<    32   33   34   35   36   37   38   39   40   41   >