The suggested configuration is good, and although we did some checking to
ensure that dovecot escapes the search queries and usernames sent to solr, so
it is not trivial to send the JNDI expansion strings to be logged by solr, it
is still good idea to set this.
Aki
> On 15/12/2021 09:45 Alessi
Hi,
for Solr you can edit your solr.in.sh file to include:
SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true"
and should be enough to prevent this vulnerability.
Ciao
Il 13/12/21 23:43, Joseph Tam ha scritto:
I'm surprised I haven't seen this mentioned yet.
An internet red alert went
On 14/12/2021 03:23, Scott wrote:
Is this assuming you log at some verbose level ? What if you log at WARN or
higher ?
For production it seems kind of silly to log search queries anyways.
Scott
It's a pretty much standard install where most things are at INFO level.
Probably could turn it d
Hello,
I have a shared mailbox set up with a private index:
maildir:/var/mail/public:INDEXPVT=~/Maildir/public
Per user \Seen flags are working fine until one user moves a message into
another folder/sub-mailbox. For that user doing the move the message remains
\Seen however for other users who
Hi,
I can add a detail, every time I get the "panic error" on the replica
node, I had one minute before this log written on the first node:
/dic 14 11:04:50 xxx dovecot[16715]:
doveadm(xxx)<16454>: Error: Couldn't lock
/mnt/mail-storage-lv0007/xxx/.dovecot-sync.lock:
fcntl(/mnt/mail-storage
