Log4J2 Vulnerability and Spring Boot

テクノロジーカテゴリーの変更を依頼記事元:

spring.io

31users がブックマークコメント

記事へのコメント3件

注目コメント
新着コメント

namisk "Spring Boot users are only affected by this vulnerability if they have switched the default logging system to Log4J2. The log4j-to-slf4j and log4j-api jars that we include in spring-boot-starter-logging cannot be exploited on their own."

2021/12/13 リンク

nilab "Our upcoming v2.5.8 & v2.6.2 releases (due Dec 23, 2021) will pickup Log4J v2.15.0, but since this is such a serious vulnerability you may want to override our dependency management and upgrade your Log4J2 dependency sooner."

2021/12/12 リンク

akira_108 “Log4J2 Vulnerability and Spring Boot”

2021/12/12 リンク

注目コメント算出アルゴリズムの一部にLINEヤフー株式会社の「建設的コメント順位付けモデルAPI」を使用しています

規約違反を報告

Log4J2 Vulnerability and Spring Boot

Updates: Since this blog post has been published, a new logback 1.2.9 version has been published.... Updates: Since this blog post has been published, a new logback 1.2.9 version has been published. While this fixes a security issue, prerequisites for exploits are very different as they "requires write access to logback's configuration file". Log4J also released a new 2.17.0 version with fixes for CVE-2021-45046 and CVE-2021-45105. Spring Boot 2.5.8 and 2.6.2 haven been released and provide depen