 |
huageV2EX 第 69678 号会员，加入于 2014-08-03 00:21:21 +08:00 |
huage 最近回复了
3 天前 回复了 huage 创建的主题 › macOS › Mac Monterey 如何快速关闭麦克风或者静音？ |
@zhaidoudou123 写多了，是快速静音的意思
12 天前 回复了 GM 创建的主题 › 云计算 › 有没有觉得阿里云的费用管理后台里功能结构混乱、很难理解？ |
阿里云的后台在这个行业里算好的了，你对比看看 AWS 、AZURE ，或者看看国内的华为云、腾讯云，要知道腾讯云连 APP 都没有，移动端是小程序。。。。。
41 天前 回复了 plasmetoz 创建的主题 › Java › 关于现在的 log4j2 漏洞的系统变量缓解方法 |
Remediation Advice:
This issue was remediated in Log4J v2.15.0. The Apache Logging Services team provides the following mitigation advice:
In previous releases (>=2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 protects against RCE by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".
You can manually check for use of affected versions of Log4J by searching your project repository for Log4J use, which is often in a pom.xml file.
Where possible, upgrade to Log4J version 2.15.0. If you are using Log4J v1 there is a migration guide available.
Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.15.0 where possible.
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.
This issue was remediated in Log4J v2.15.0. The Apache Logging Services team provides the following mitigation advice:
In previous releases (>=2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 protects against RCE by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".
You can manually check for use of affected versions of Log4J by searching your project repository for Log4J use, which is often in a pom.xml file.
Where possible, upgrade to Log4J version 2.15.0. If you are using Log4J v1 there is a migration guide available.
Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.15.0 where possible.
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.
60 天前 回复了 huage 创建的主题 › macOS › mac（m1）有哪些好用的个人免费的 ssh 客户端工具 |
@dangyuluo just like xshell, or even better than xhsell
63 天前 回复了 LeeReamond 创建的主题 › Elasticsearch › Elasticsearch 在未来会全面替代传统的关系型数据库吗？使用上有什么坑吗？ |
不可能广泛使用，术业有专攻，将不同的软件和技术用到一起的集大成者才是王道
65 天前 回复了 CivAx 创建的主题 › MacBook Pro › 澳门 16'' M1Max 到手了，昨天找人买今天就送到，折合比国内便宜 4800 |
内地学校的学生，是怎么在澳门的线下商店购买的？
Select Language