git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [RFC] squelch log4j inquiries

From
Junio C Hamano <gitster@pobox.com>
Date
Dec 25, 2021, 00:38 UTC
Message-ID
<xmqqo8551psz.fsf@gitster.g>
In-Reply-To
<01d201d7f85b$4bffb2c0$e3ff1840$@nexbridge.com>
<rsbecker@nexbridge.com> writes:
Show 9 quoted lines
>> +No part of Git is written in Java, hence it is not susceptible to the
>> +log4j vulnerability that has been causing sensation recently.
>> +
> ...
> This is a good idea. I have had to reassure a whole bunch of people in my
> community about this, not really because of git itself but because of the
> Maven build associated with EGit/JGit that may (do) have this issue if the
> wrong version of log4j is available. I would rather not discuss the
> particulars of the attack vector in this mailing list.

As you can point those people at the message that started this thread at the lore archive, I actually think that I already have done enough to achieve our goal ;-)

Previous: rsbecker@nexbridge.comNext: Philip Oakley
Message 3 of 4 in “[RFC] squelch log4j inquiries”
  1. Junio C HamanoDec 23, 2021
  2. rsbecker@nexbridge.comDec 24, 2021
  3. Junio C HamanoDec 25, 2021
  4. Philip OakleyDec 24, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.