vy opened a new pull request, #1948: URL: https://github.com/apache/logging-log4j2/pull/1948
This implements the following changes in [the security page](https://logging.apache.org/log4j/2.x/security.html): * Switched from [MITRE](https://cve.mitre.org) to [NVD](https://nvd.nist.gov/) – Both are in essence funded by the same organization (i.e., the U.S. Government) and contain identical data. Though MITRE seems dead and NVD looks alive with more bells and whistles. * Switched to CVSS 3.x severity and metrics * Improved navigation with more user-centric sections and expanded menu * Added _"Components affected"_ (e.g., `log4j-core`) field * Added _"Versions fixed"_ field * Removed duplicate content * Simplified textual content – kept basic description and mitigation techniques * Removed mitigation techniques worded as _"alternatively you can do X, but it won't really help"_ ### Review aid - Old [security.md](https://github.com/apache/logging-log4j2/blob/2.x/src/site/markdown/security.md) - New [security.adoc](https://github.com/apache/logging-log4j2/blob/security-page/src/site/asciidoc/security.adoc) ### References - Structuring and wording are inspired by [the PostgreSQL Security page](https://www.postgresql.org/support/security/). - This work is a part of the #1707 bundle. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
