https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(security-response |needinfo?(jwon(a)redhat.com)
|-team(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Torsten Mielke <tmielke(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
CC| |tmielke(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
--- Comment #60 from Stoyan Nikolov <snikolov(a)redhat.com> ---
In reply to comment #55:
> Hi
> I have got a customer, who wanted to know, is there any impact of this
> vulnerability (CVE-2021-44228) on following products:
> Quay 3.4.6 and Clair3.4.6 ?
>
> Regards
> Selim
Quay and Clair are not affected. Quay uses log4js, which is close name-wise but
is not related to the log4j project.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Brendan Shephard <bshephar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |bshephar(a)redhat.com
--- Comment #59 from Brendan Shephard <bshephar(a)redhat.com> ---
For RHOSP13, the impacted component is Opendaylight, to verify if you are using
Opendaylight in your deployment, you can use the command below to check:
$ openstack stack environment show overcloud | egrep
"OS::TripleO::Services::OpenDaylightApi:|OS::TripleO::Services::OpenDaylightOvs:"
OS::TripleO::Services::OpenDaylightApi: OS::Heat::None
OS::TripleO::Services::OpenDaylightOvs: OS::Heat::None
If these return as OS::Heat::None like in the example above, you are not using
OpenDayLight and therefore not impacted by this CVE.
More information about Opendaylight can be found here:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/...https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/...
Note that this is NOT the default in RHOSP13, by default this service is not
enabled and used, you would need to explicitly enable it using the steps
documented in the links above.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |sfowler(a)redhat.com
--- Comment #58 from Sam Fowler <sfowler(a)redhat.com> ---
(In reply to Al from comment #56)
> Is setting the LOG4J_FORMAT_MSG_NO_LOOKUPS env variable in OpenShift (f.e.
> through oc set env), instead of specifying the log4j2.formatMsgNoLookups
> system property, a valid mitigation for log4j2 2.10+?
Yes, this is the advised method for OpenShift linked in this article from the
Mitigation section on our CVE page:
https://access.redhat.com/solutions/6578421
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(security-response |needinfo?(jwon(a)redhat.com)
|-team(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Al <amiftah(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
CC| |amiftah(a)redhat.com,
| |security-response-team@redh
| |at.com
--- Comment #56 from Al <amiftah(a)redhat.com> ---
Is setting the LOG4J_FORMAT_MSG_NO_LOOKUPS env variable in OpenShift (f.e.
through oc set env), instead of specifying the log4j2.formatMsgNoLookups system
property, a valid mitigation for log4j2 2.10+?
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030932