Yet another CVE-2021-45105 in Log4j < 2.17.0, analysis of impact to Pulsar

2021-12-18 Thread Lari Hotari
Dear Pulsar community members, There's yet another new CVE, CVE-2021-45105 in Log4j < 2.17.0 details: https://logging.apache.org/log4j/2.x/security.html Summary: Pulsar isn't impacted with CVE-2021-45105 when the default log4j configuration provided with Pulsar is used. However, remember that Pu

Re: [VOTE] Pulsar Release 2.7.4 Candidate 1

2021-12-18 Thread Enrico Olivelli
Jiwei Guo, Thanks for driving the release today is Saturday, so I am not sure how many people will have time to test the release candidate during the 72 hours period (for instance I can do it only on Monday, hopefully). Please take this into consideration when you are going to close the VOTE, maybe

Re: [VOTE] Apache Pulsar 2.9.1 candidate 2

2021-12-18 Thread PengHui Li
+1 binding Penghui Enrico Olivelli 于2021年12月18日 周六18:39写道: > +1 (binding) > > - Run release validation procedure > - CI is passing on those sources > > Enrico > > Il giorno sab 18 dic 2021 alle ore 02:51 PengHui Li > ha > scritto: > > > > Will this issue be fixed in the future releases? > > >

Re: [VOTE] Apache Pulsar 2.9.1 candidate 2

2021-12-18 Thread Enrico Olivelli
+1 (binding) - Run release validation procedure - CI is passing on those sources Enrico Il giorno sab 18 dic 2021 alle ore 02:51 PengHui Li ha scritto: > > Will this issue be fixed in the future releases? > > Yes, 2.8.2 and 2.9.2 will fix the problem. > > Penghui > > On Sat, Dec 18, 2021 at 3

[VOTE] Pulsar Release 2.7.4 Candidate 1

2021-12-18 Thread guo jiwei
This is the first release candidate for Apache Pulsar, version 2.7.4. It fixes the following issues: https://github.com/apache/pulsar/pulls?q=is%3Apr+is%3Aopen+label%3Arelease%2F2.7.4+is%3Apr+ Release note: https://github.com/apache/pulsar/pull/13391 *** Please download, test and vote on this re