This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch main-site-pro-out
in repository https://gitbox.apache.org/repos/asf/logging-site.git
The following commit(s) were added to refs/heads/main-site-pro-out by this push:
new 253da803 Add website content generated from
`c63061e224e5eb71dbf6257e425f44500d9791b5`
253da803 is described below
commit 253da803545595e926739405f32747da4e637aa6
Author: ASF Logging Services RM <[email protected]>
AuthorDate: Thu May 28 14:06:25 2026 +0000
Add website content generated from
`c63061e224e5eb71dbf6257e425f44500d9791b5`
---
security/faq.html | 46 +++++++++++++++++++++++++++++++++++++++-------
sitemap.xml | 42 +++++++++++++++++++++---------------------
2 files changed, 60 insertions(+), 28 deletions(-)
diff --git a/security/faq.html b/security/faq.html
index 179e1212..cc127578 100644
--- a/security/faq.html
+++ b/security/faq.html
@@ -310,23 +310,55 @@ Common oversights include:</p>
</div>
</div>
<div class="sect2">
-<h3 id="crlf-injection-rfc5424-layout"><a class="anchor"
href="#crlf-injection-rfc5424-layout"></a>RFC 5424 layout</h3>
+<h3 id="crlf-injection-rfc5424-layout"><a class="anchor"
href="#crlf-injection-rfc5424-layout"></a>Syslog and RFC 5424 layouts</h3>
<div class="paragraph">
-<p><strong>Claim</strong>: RFC 5424 layout is vulnerable to CRLF injection
because it does not escape CRLF characters by default.</p>
+<p><strong>Claim</strong>: The Syslog and RFC 5424 layouts are vulnerable to
CRLF injection because they do not escape CRLF characters by default.</p>
+</div>
+<div class="paragraph">
+<p>Log4j Core provides two syslog-oriented layouts:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the <strong>RFC 5424 layout</strong>, which follows <a
href="https://datatracker.ietf.org/doc/html/rfc5424";>RFC 5424</a> (the modern
syslog protocol), and</p>
+</li>
+<li>
+<p>the <strong>Syslog layout</strong>, which follows <a
href="https://datatracker.ietf.org/doc/html/rfc3164";>RFC 3164</a> (the legacy
BSD syslog format).</p>
+</li>
+</ul>
</div>
<div class="paragraph">
<p>RFC 5424 layout is a <strong>structured format</strong> with well-defined
fields and delimiters, enabling reliable and unambiguous parsing.
-However, per <a
href="https://datatracker.ietf.org/doc/html/rfc5424#section-8.2";>Section 8.2 of
RFC 5424</a>, the spec itself does <strong>not</strong> require escaping of
control characters (including CRLF) in the <code>PARAM-VALUE</code> or
<code>MSG</code> fields.
-Instead, responsibility for handling those characters is delegated to the
<strong>transport binding</strong> in use.</p>
+RFC 3164 is weaker: it is an <em>informational</em> document that describes
observed BSD syslog behavior rather than mandating a strict format.</p>
</div>
<div class="paragraph">
-<p>For this reason, Log4j Core does not escape CRLF characters by default, and
this is <strong>not</strong> considered a vulnerability.</p>
+<p>Neither spec, however, requires escaping of control characters (including
CRLF) in the message body.
+Per <a
href="https://datatracker.ietf.org/doc/html/rfc5424#section-8.2";>Section 8.2 of
RFC 5424</a>, the spec does <strong>not</strong> require escaping such
characters in the <code>PARAM-VALUE</code> or <code>MSG</code> fields, and RFC
3164 leaves their handling unspecified altogether.
+In both cases, responsibility for handling those characters is delegated to
the <strong>transport binding</strong> in use.</p>
+</div>
+<div class="paragraph">
+<p>For this reason, neither layout escapes CRLF characters by default, and
this is <strong>not</strong> considered a vulnerability.</p>
+</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>The <a
href="https://logging.apache.org/log4j/2.x/manual/appenders.html#SyslogAppender";>Syslog
appender</a> can be configured with either layout: the RFC 5424 layout
(<code>format="RFC5424"</code>) or the Syslog layout
(<code>format="BSD"</code>, the default).
+The considerations described here apply to the appender regardless of which of
the two layouts it uses.</p>
+</div>
+</td>
+</tr>
+</table>
</div>
<div class="sect3">
<h4 id="crlf-injection-rfc5424-layout-why-not"><a class="anchor"
href="#crlf-injection-rfc5424-layout-why-not"></a>Why this is not a
vulnerability</h4>
<div class="paragraph">
<p>The appropriate handling of CRLF characters depends on which transport
protocol carries the log messages.
-RFC 5424 is used with several protocol bindings, each with different framing
semantics:</p>
+These layouts are used with several protocol bindings, each with different
framing semantics:</p>
</div>
<div class="dlist">
<dl>
@@ -359,7 +391,7 @@ Defaulting to no escaping preserves the original log data
while allowing each tr
</td>
<td class="content">
<div class="paragraph">
-<p>RFC 5424 layout does support optional CRLF escaping, which you can enable
explicitly when using a transport that requires it (such as legacy TCP over RFC
6587).
+<p>Both layouts support optional CRLF escaping, which you can enable
explicitly when using a transport that requires it (such as legacy TCP over RFC
6587).
Refer to the layout configuration reference for details.</p>
</div>
<div class="paragraph">
diff --git a/sitemap.xml b/sitemap.xml
index cd1d179b..9ba559c9 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -2,86 +2,86 @@
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9";>
<url>
<loc>https://logging.apache.org/blog/20231117-flume-joins-logging-services.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231128-new-pmc-member.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231202-apache-common-logging-1.3.0.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231214-announcing-support-from-the-stf.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231218-20-years-of-innovation.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240725-Log4j-At-Community-Over-Code-2024.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240808-welcome-to-the-pmc-jan.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240812-log4j-bug-bounty.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20250728-introduction-to-vex-files.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/index.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/charter.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/download.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/guidelines.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/index.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/processes.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security/faq.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/support.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/team-list.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/what-is-logging.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/xml/ns/index.html</loc>
-<lastmod>2026-05-17T21:41:09.261Z</lastmod>
+<lastmod>2026-05-28T14:06:21.425Z</lastmod>
</url>
</urlset>
