FrankChen021 commented on pull request #12051:
URL: https://github.com/apache/druid/pull/12051#issuecomment-995361286
@GElkayam I checked the description of that CVE. If I understand correctly,
this vulnerability exists when thread context map pattern layout is applied.
Since Druid's default log4j2 configuration does not use such pattern layout,
I think it's not affected by this problem.
> This could allow attackers with control over Thread Context Map (MDC)
input data when the logging configuration uses a non-default Pattern Layout
with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context
Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI
Lookup pattern resulting in a denial of service (DOS) attack.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
