Skip to content

remove use of unsupported log4gv1 #5941

Closed
#5878
Closed
remove use of unsupported log4gv1#5941
#5878
Labels
type:security
Milestone
4.16.1.0

Description

@pjfanning
pjfanning
opened on Feb 6, 2022
ISSUE TYPE
  • Improvement Request

https://github.com/apache/cloudstack/blob/main/pom.xml#L79

Log4jv1 has not been supported in many years and has multiple CVEs open against it. The ASF gets multiple daily queries/requests about log4j and most of them are expecting us to upgrade

  • log4jv2 2.17.1 and above is one option
  • reload4j is a fork of log4j that is maintained

Activity

  1. yadvr commented on Feb 6, 2022

    @yadvr
    yadvr
    on Feb 6, 2022
    Member

    Thanks for the report, I've already raised a PR to fix this issue. #5878

  2. yadvr
    added this to the 4.16.1.0 milestone on Feb 6, 2022
  3. yadvr
    linked a pull request that will close this issuemaven: migrate short-term to reload4j v1.2.18 #5878on Feb 6, 2022
  4. sureshanaparti
    added this to Apache CloudStack 4.16.1on Feb 7, 2022
  5. sureshanaparti
    moved this to Ready For Review in Apache CloudStack 4.16.1on Feb 7, 2022

  6. sureshanaparti commented on Feb 8, 2022

    @sureshanaparti
    sureshanaparti
    on Feb 8, 2022
    Contributor

    Fixed in #5878

  7. sureshanaparti
    closed this as completedon Feb 8, 2022
  8. Repository owner moved this from Ready For Review to Done in Apache CloudStack 4.16.1on Feb 8, 2022
  9. sureshanaparti
    added
    type:security
    on Feb 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type:security

    Type

    No type

    Projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions