You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When a Logger adapter is destroyed, it will call commit to ensure that any pending messages while in transactional mode are written in the log file.
This introduces potentially a security threat, for applications that utilize serializing or unserializing objects such as the logger.
The logger adapters will have the serialize/unserialize functionality removed.
Credit: Zach Leigh, who contacted us with this vulnerability. The example is an edge case and has a few prerequisites so as to expose the vulnerability, but for an abundance of caution, we are issuing this fix.
The text was updated successfully, but these errors were encountered:
When a Logger adapter is destroyed, it will call
commit
to ensure that any pending messages while in transactional mode are written in the log file.This introduces potentially a security threat, for applications that utilize serializing or unserializing objects such as the logger.
The logger adapters will have the
serialize
/unserialize
functionality removed.Credit: Zach Leigh, who contacted us with this vulnerability. The example is an edge case and has a few prerequisites so as to expose the vulnerability, but for an abundance of caution, we are issuing this fix.
The text was updated successfully, but these errors were encountered: