<feed xmlns='http://www.w3.org/2005/Atom'>
<title>openstack/kolla.git/docker/storm/storm-base/Dockerfile.j2, branch train-eol</title>
<subtitle>Unnamed repository; edit this file 'description' to name the repository.
</subtitle>
<id>https://git.platform-os.org/openstack/kolla.git/atom?h=train-eol</id>
<link rel='self' href='https://git.platform-os.org/openstack/kolla.git/atom?h=train-eol'/>
<link rel='alternate' type='text/html' href='https://git.platform-os.org/openstack/kolla.git/'/>
<updated>2022-01-27T09:42:27+00:00</updated>
<entry>
<title>Mitigate two Log4j vulnerabilities in Apache Storm</title>
<updated>2022-01-27T09:42:27+00:00</updated>
<author>
<name>Pierre Riteau</name>
<email>pierre@stackhpc.com</email>
</author>
<published>2022-01-13T21:35:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.platform-os.org/openstack/kolla.git/commit/?id=fe9b3ccb645ebeffd7d84ef4fcc93b90a6661a4a'/>
<id>urn:sha1:fe9b3ccb645ebeffd7d84ef4fcc93b90a6661a4a</id>
<content type='text'>
The Log4j version was bumped on GitHub [1] but it is still pending
inclusion in a release of Apache Storm.

Apply the alternative mitigation recommended by Log4j [2] of removing
the JndiLookup class from the classpath.

[1] https://github.com/apache/storm/pull/3427
[2] https://logging.apache.org/log4j/2.x/security.html

Change-Id: Ib3ecd73f9e39e320acb2c5f0962b8af9b1a817e9
(cherry picked from commit 448e4f56aa6218a66b0074329d322c0b6089b2e6)
</content>
</entry>
<entry>
<title>Add a storm-base image</title>
<updated>2021-01-23T08:52:34+00:00</updated>
<author>
<name>Mark Goddard</name>
<email>mark@stackhpc.com</email>
</author>
<published>2021-01-12T16:18:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.platform-os.org/openstack/kolla.git/commit/?id=890d199e98dcc0edaf0ccc5ac8a0c479d3209efc'/>
<id>urn:sha1:890d199e98dcc0edaf0ccc5ac8a0c479d3209efc</id>
<content type='text'>
Refactor storm image dependencies. Previously we had:

base -&gt; storm -&gt; monasca-thresh

Both storm and monasca-thresh images are final, and each includes a
footer. This causes issues when the footer expects to be at the end of
the image, or there to be only a single footer. In particular, since
I2592a736206eaec811290e9fbdbf2540c0518ffe, the footer used in CI jobs
reverts to the public package mirrors.

This change introduces a storm-base image, and refactors the dependency
chain:

base -&gt; storm-base -&gt; storm
base -&gt; storm-base -&gt; monasca-thresh

Related-Bug: #1902101

Change-Id: I53e8ba8d4baa4434cf3c49ed94d1f7cb44099bee
(cherry picked from commit 93204ecfeca7ba394bd4c3872147357aa708f46e)
</content>
</entry>
</feed>
