Re: CVE-2021-44228 Log4j 2 Vulnerability -- How does this affect Tomcat?

2021-12-14 Thread Niranjan Rao
This is one of the best explanation I've seen. And it does not use the word Minecraft to emphasis the importance. Thank you. Niranjan On 12/13/21 3:36 PM, Christopher Schultz wrote: James, On 12/13/21 14:48, James H. H. Lampert wrote: On 12/13/21 10:53 AM, Mark Thomas wrote: Log4j2 supports

Re: CVE-2021-44228 Log4j 2 Vulnerability -- How does this affect Tomcat?

2021-12-14 Thread Christopher Schultz
James, On 12/13/21 19:24, James H. H. Lampert wrote: I can *barely* wrap my mind around the idea of getting executable code from an RMI server, but what legitimate purpose could be served by allowing a *logger* to resolve executable code? None. The designers of log4j probably were thinking "h

Re: CVE-2021-44228 Log4j 2 Vulnerability -- How does this affect Tomcat?

2021-12-14 Thread Tim Funk
LOG4J2 allows for multiple keyword types of keyword expansions in the logs. Keyword expansion is a "great way" to log items possibly only known at run time. And with trace, debug level logging - Comparing those expanded values to logged values makes debugging "easier". (The closest you'll get to br

[SECURITY] Apache Tomcat and CVE-2021-44228 (Log4j vulnerability)

2021-12-14 Thread Mark Thomas
The following represents the current understanding of the Apache Tomcat security team at the time this announcement was issued. There is a lot of security research being focussed on log4j2 at the moment and it is probable that additional information will emerge. Currently supported Tomcat vers