java | Java Dockerfile for trusted automated Docker builds | Continuous Deployment library

I have newly installed

I'm trying to initiate a Springboot project using Open Jdk 15, Springboot 2.6.0, Springfox 3. We are working on a project that replaced Netty as the webserver and used Jetty instead because we do not need a non-blocking environment.

In the code we depend primarily on Reactor API (Flux, Mono), so we can not remove org.springframework.boot:spring-boot-starter-webflux dependencies.

I replicated the problem that we have in a new project.: https://github.com/jvacaq/spring-fox.

I figured out that these lines in our build.gradle file are the origin of the problem.

I've just updated my flutter project packages to be null-safety compliant and now Android Studio wants me to update my project to use the latest version of Kotling Gradle Plugin. Can't see where to change this though. I have tried to change "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version" into "org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.6.10" but this has no effect.

My build.grade-file looks like this:

I recently downloaded Android Studio Bumblebee and it helpfully asked whether I wanted to upgrade to Android Gradle Plugin 7.1.0, the version that shipped alongside Android Studio Bumblebee.

After upgrading, I get a build error:

I'm facing a weird issue. Before I updated my Android Studio, everything went fine in flutter doctor. Once I've updated Android Studio, when I run the doctor, it's showing "Unable to find bundled Java version". I've already downloaded Java installer and installed it on my M1 Mac, but after I restarted, running flutter doctor still shows the same error. The weird thing is, when I uninstall the Arctic Fox version and re-install the older Android Studio version, everything goes fine again when running the doctor. How can I resolve this?

After upgrading to android 12, the application is not compiling. It shows

"Manifest merger failed with multiple errors, see logs"

Error showing in Merged manifest:

Merging Errors: Error: android:exported needs to be explicitly specified for . Apps targeting Android 12 and higher are required to specify an explicit value for android:exported when the corresponding component has an intent filter defined. See https://developer.android.com/guide/topics/manifest/activity-element#exported for details. main manifest (this file)

I have set all the activity with android:exported="false". But it is still showing this issue.

My manifest file:

Targeting S+ (version 31 and above) requires that one of FLAG_IMMUTABLE or FLAG_MUTABLE be specified when creating a PendingIntent. I got it after updating target SDK to 31. the error always come after AlarmPingSender. But i dont know any class that used AlarmPingSender.

I'm having an issue when i'm uploading app bundle to the play console that You uploaded an APK or Android App Bundle which has an activity, activity alias, service or broadcast receiver with intent filter, but without 'android:exported' property set. This file can't be installed on Android 12 or higher. but my manifest file includes the property.

Manifest file

With regard to the Log4j JNDI remote code execution vulnerability that has been identified CVE-2021-44228 - (also see references) - I wondered if Log4j-v1.2 is also impacted, but the closest I got from source code review is the JMS-Appender.

The question is, while the posts on the Internet indicate that Log4j 1.2 is also vulnerable, I am not able to find the relevant source code for it.

Am I missing something that others have identified?

Log4j 1.2 appears to have a vulnerability in the socket-server class, but my understanding is that it needs to be enabled in the first place for it to be applicable and hence is not a passive threat unlike the JNDI-lookup vulnerability which the one identified appears to be.

Is my understanding - that Log4j v1.2 - is not vulnerable to the jndi-remote-code execution bug correct?

• Apache Log4j Security Vulnerabilities

• Zero-day in ubiquitous Log4j tool poses a grave threat to the Internet

• Worst Apache Log4j RCE Zero day Dropped on Internet

• ‘Log4Shell’ vulnerability poses critical threat to applications using ‘ubiquitous’ Java logging package Apache Log4j

This blog post from Cloudflare also indicates the same point as from AKX....that it was introduced from Log4j 2!

Update #1 - A fork of the (now-retired) apache-log4j-1.2.x with patch fixes for few vulnerabilities identified in the older library is now available (from the original log4j author). The site is https://reload4j.qos.ch/. As of 21-Jan-2022 version 1.2.18.2 has been released. Vulnerabilities addressed to date include those pertaining to JMSAppender, SocketServer and Chainsaw vulnerabilities. Note that I am simply relaying this information. Have not verified the fixes from my end. Please refer the link for additional details.