Eclipse Community Forums: M2T (model-to-text transformation) » log4j 1.X series high-risk vulnerability

Home » Modeling » M2T (model-to-text transformation) » log4j 1.X series high-risk vulnerability(Is the log4j 1.X series high-risk vulnerability affect the xpand?)

Show: Today's Messages :: Show Polls :: Message Navigator

log4j 1.X series high-risk vulnerability [message #1849506]

Sat, 22 January 2022 02:51

guo qing

Messages: 2
Registered: January 2022

Junior Member

Is the log4j 1.X series high-risk vulnerability affect the xpand? if anyone know about it, give me a reply, thanks

Report message to a moderator

Re: log4j 1.X series high-risk vulnerability [message #1849514 is a reply to message #1849506]

Sat, 22 January 2022 17:50

Ed Willink

Messages: 7655
Registered: July 2009

Senior Member

Hi

It is thought that many Eclipse project use log4j 1.2.5 in a very trivial logging fashion that offers no opportunities to the esoteric hazard. Nobody is rushing to cure the not-a-problem.

Regards

Ed Willink

Report message to a moderator

Re: log4j 1.X series high-risk vulnerability [message #1849534 is a reply to message #1849506]

Mon, 24 January 2022 08:40

Karsten Thoms

Messages: 762
Registered: July 2009
Location: Dortmund, Germany

Senior Member

AFAIK the Log4Shell vulnerability is affecting log4j4 2 only.
Vulnerability is only when accessible form the net. Xpand is usually only used at build time anyway.

Report message to a moderator

Re: log4j 1.X series high-risk vulnerability [message #1849536 is a reply to message #1849534]

Mon, 24 January 2022 09:26

Ed Willink

Messages: 7655
Registered: July 2009

Senior Member

Hi

The cross-project thread did indeed identify that the recent threat is for Log4j 2, but also noted that there is an outstanding problem for log4j 1 . My understanding is that if the logging of a message provides an opportunity for an external web entity to format the message then a malicious external web entity can do bad things.. I understand that the log4j 1 reloaded project [1] removes this dangerous flexibility. Of course normal programs just format and log the message locally without troubling the web. So not-a-problem. I suspect that the reloaded log4j will appear in Orbit soon and we will all use it.

Regards

Ed Willink

[1] https://reload4j.qos.ch/

Report message to a moderator

Previous Topic:	[Acceleo] Are there tutorials / examples available?
Next Topic:	Acceleo Traceability

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Thu Apr 25 01:52:11 GMT 2024

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter