<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you. We are still running 4.0.1 as well so this was very helpful.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Ryan Rumbaugh<o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Paul Caskey <pcaskey@internet2.edu><br>
<b>Date: </b>Friday, December 10, 2021 at 4:28 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>RE: Log4j CVE (non)-impact<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Non-NU Email<br>
<br>
OK, I did a 4.0.1 container too:<br>
i2incommon/shib-idp:4.0.1_20211210<br>
<br>
<br>
> -----Original Message-----<br>
> From: users <users-bounces@shibboleth.net> On Behalf Of John C. Pfeifer<br>
> Sent: Friday, December 10, 2021 2:00 PM<br>
> To: Shib Users <users@shibboleth.net><br>
> Cc: announce@shibboleth.net<br>
> Subject: Re: Log4j CVE (non)-impact<br>
> <br>
> Pail, any chance of a new 4.0.1 image? We are not quite ready to just to 4.1.x.<br>
> <br>
> //<br>
> John Pfeifer<br>
> Division of Information Technology<br>
> University of Maryland, College Park<br>
> <br>
> > On Dec 10, 2021, at 2:50 PM, Paul Caskey <pcaskey@internet2.edu> wrote:<br>
> ><br>
> > Just a note that the InCommon Trusted Access Platform uses tomcat and<br>
> log4j in the IdP container and was vulnerable to this.<br>
> ><br>
> > A patched version of the TAP IdP container image is available at the Docker<br>
> hub: "i2incommon/shib-idp:4.1.4_20211210" or "i2incommon/shib-idp:latest"<br>
> ><br>
> ><br>
> > Thanks,<br>
> > -Paul<br>
> ><br>
> ><br>
> >> -----Original Message-----<br>
> >> From: announce <announce-bounces@shibboleth.net> On Behalf Of<br>
> Cantor,<br>
> >> Scott<br>
> >> Sent: Friday, December 10, 2021 9:49 AM<br>
> >> To: announce@shibboleth.net<br>
> >> Subject: Log4j CVE (non)-impact<br>
> >><br>
> >> We’re getting a lot of noise about this, just trying to save more emails<br>
> here.<br>
> >><br>
> >> Shibboleth does not use log4j. We ship a bridge for it to slf4j but<br>
> >> that's not vulnerable, the bug is in log4j itself. We allow (in<br>
> >> theory) the IdP to be manipulated to log to log4j through the slf4j<br>
> >> API but we don't ship that or provide any code or examples for doing that.<br>
> >><br>
> >> The Jetty on Windows package is equipped with logback for logging,<br>
> >> not log4j.<br>
> >><br>
> >> Otherwise, we have nothing to do with the servlet container<br>
> >> configuration and logging choices you yourselves may or may not have<br>
> >> made, or any other packaging of our software that may include log4j<br>
> >> from other sources, that's outside our scope as a project.<br>
> >><br>
> >> -- Scott<br>
> >><br>
> >><br>
> >> --<br>
> >> To unsubscribe from this list send an email to announce-<br>
> >> unsubscribe@shibboleth.net<br>
> > --<br>
> > For Consortium Member technical support, see<br>
> > <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$</a>
<br>
> > To unsubscribe from this list send an email to<br>
> > users-unsubscribe@shibboleth.net<br>
> <br>
> --<br>
> For Consortium Member technical support, see<br>
> <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$</a>
<br>
> To unsubscribe from this list send an email to users-<br>
> unsubscribe@shibboleth.net<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!PvXuogZ4sRB2p-tU!WFr5leIT8GOWM449VcaB8mdE-CvVa-xAA4Wt2dVqazi7vJt-Jp9Av1KTolr1Y_a5HzGx$</a>
<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></span></p>
</div>
</div>
</body>
</html>