[Axis2] Clustering support about to be removed, any users please speak up now

--00000000000084e21006373884d2
Content-Type: text/plain; charset="UTF-8"

Hello Axis2 Community,

Axis2 has what appears to be a seldom used optional feature - clustering -
and it has been brought to our attention that it has insecure
code, demonstrated by a small proof of concept exploitation.

To be clear - you have to manually enable clustering. It is off by default.

This clustering support has a dependency on Tomcat 11, which was recently
discussed by the committers as odd and no one knows about any users.

Apache policy is not to disclose details on public lists - if interested in
creating a GitHub PR for a fix -  send me an email.

If you are interested in keeping clustering in Axis2 but are not able to
contribute code - let us know.

If no one speaks up, we will plan for a 2.0.1 release without clustering.

--00000000000084e21006373884d2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello Axis2 Community,=C2=A0</div><div><br></div><div=
>Axis2 has what appears to be a seldom used optional feature - clustering -=
 and it has been brought to our attention that it has insecure code,=C2=A0d=
emonstrated by a small proof of concept exploitation.=C2=A0</div><div><br><=
/div><div>To be clear - you have to manually enable clustering. It is off b=
y default.=C2=A0</div><div><br></div><div>This clustering support has a dep=
endency on Tomcat 11, which was recently discussed by the committers as odd=
 and no one knows about any users.=C2=A0</div><div><br></div><div><div>Apac=
he=C2=A0policy is not to disclose details on public lists - if interested=
=C2=A0in creating a GitHub PR for a fix -=C2=A0 send=C2=A0me an email.=C2=
=A0</div><div><br></div><div>If you are interested in keeping clustering in=
 Axis2 but are not able to contribute code - let us know.=C2=A0</div><div><=
br></div><div>If no one speaks up, we will plan for a 2.0.1 release without=
 clustering.=C2=A0</div><div><br></div><br></div></div>

--00000000000084e21006373884d2--