This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch main-site-stg-out
in repository https://gitbox.apache.org/repos/asf/logging-site.git
The following commit(s) were added to refs/heads/main-site-stg-out by this push:
new 6491c2de Add website content generated from
`2cd27ed3f3f88ff94d8269f89b7239077ac92aff`
6491c2de is described below
commit 6491c2de4302da92fd1462c64e5eadfc2be16323
Author: ASF Logging Services RM <[email protected]>
AuthorDate: Thu Aug 27 06:50:13 2026 +0000
Add website content generated from
`2cd27ed3f3f88ff94d8269f89b7239077ac92aff`
---
security/faq.html | 10 ++++++++--
sitemap.xml | 42 +++++++++++++++++++++---------------------
2 files changed, 29 insertions(+), 23 deletions(-)
diff --git a/security/faq.html b/security/faq.html
index 4242b7b6..e54ca8a6 100644
--- a/security/faq.html
+++ b/security/faq.html
@@ -502,12 +502,18 @@ The fact that Log4j classes happen to appear in such a
stream does not make Log4
<p>Log4j 1 shipped a <code>SocketServer</code> and a
<code>SocketAppender</code> that exchanged log events over the network using
Java serialization.</p>
</div>
<div class="paragraph">
-<p>In Log4j 2:</p>
+<p>Log4j 2 inherited this functionality: up to and including the 2.8.x
releases, <code>log4j-core</code> contained TCP and UDP socket servers
(<code>TcpSocketServer</code> and <code>UdpSocketServer</code>) that received
serialized log events from other applications.
+As with any endpoint that consumes serialized data from the network, these
servers were dangerous to operate and resulted in <a
href="../security.html#CVE-2017-5645" class="xref page">CVE-2017-5645</a>.</p>
+</div>
+<div class="paragraph">
+<p>The vulnerability was patched in version <code>2.8.2</code> by introducing
<code>FilteredObjectInputStream</code>, an allowlist-based equivalent for Java
7 of the <code>ObjectInputFilter</code> API introduced in Java 9.
+Since this fix could not cover all cases, the socket servers were removed
entirely in the next release, <code>2.9.0</code>.
+Since then:</p>
</div>
<div class="ulist">
<ul>
<li>
-<p>The <code>SocketServer</code> receiver was never reintroduced into the
production codebase.</p>
+<p>No socket server has ever been reintroduced into the production
codebase.</p>
</li>
<li>
<p><code>SerializedLayout</code>, originally provided for Log4j 1
compatibility, has been <strong>deprecated since version 2.9</strong> and
should not be used.
diff --git a/sitemap.xml b/sitemap.xml
index 1ee90ebc..aaa6f233 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -2,86 +2,86 @@
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9";>
<url>
<loc>https://logging.apache.org/blog/20231117-flume-joins-logging-services.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231128-new-pmc-member.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231202-apache-common-logging-1.3.0.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231214-announcing-support-from-the-stf.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231218-20-years-of-innovation.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240725-Log4j-At-Community-Over-Code-2024.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240808-welcome-to-the-pmc-jan.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240812-log4j-bug-bounty.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20250728-introduction-to-vex-files.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/index.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/charter.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/download.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/guidelines.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/index.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/processes.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security/faq.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/support.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/team-list.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/what-is-logging.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/xml/ns/index.html</loc>
-<lastmod>2026-08-18T13:17:40.758Z</lastmod>
+<lastmod>2026-08-27T06:50:11.597Z</lastmod>
</url>
</urlset>
