CVE-2021-44228 (Apache log4j) tracking issue #150288

ius · 2021-12-11T18:45:10Z

I used nix-locate to find instances of log4j v2 (possibly affected by CVE-2021-44228).

nix-locate -1 log4j-core-2 | uniq | tr '\n' ' '
nix-locate -1 log4j-api-2 | uniq | tr '\n' ' '

Packages listed below contain a log4j jar. Note that shipping the log4j jar does not imply vulnerability nor exploitability. This list is not exhaustive for many reasons (using 21.11 as nix-locate index; packages not cached thus not indexed).

Not vulnerable means I believe 21.05/21.11/unstable is not affected.

Package	Status
apache-jena	Fixed #150610 #150650 - 21.05?
arduino-core	Upstream fix released, not packaged
arduino	Upstream fix released, not packaged
elasticsearch7	Fixed #150879 #150986
elasticsearch6	Fixed #150879 #150986
elasticsearch6-oss	Fixed #150879 #150986
flink	Upstream fix released - #151776
ghidra-bin	Fixed #150154 #150159 #150211
graylog	Fixed #150511 #150594 #150904
igv	Upstream fixed, not packaged
jitsi-videobridge	Not vulnerable #150021 #150027 (missing 21.05 backport) Upstream: Jitsi-videobridge instances older than 2.1-504 (May 2021) with callstats enabled should be updated to 2.1-504 or newer (source)
jmeter	Fixed #151080 #151087
logstash6	Fixed #150879 #150986
logstash7	Fixed #150879 #150986
logstash6-oss	Fixed #150879 #150986
logstash7-oss	Fixed #150879 #150986
signald	Fixed #150479 #150523 #150526
solr	8.11.1 released (2.16.0), not packaged - mitigated by adding `services.solr.extraJavaOptions = [ "-Dlog4j.formatMsgNoLookups=true" ];` to your configuration
storm	Upstream fixed (2.17.0), but unreleased
xmlbeans	Upstream fixed (2.17.0) but unreleased
zap	Fixed (2.15.0) #150289 #150406 #150295 (no 2.17.0 released planned source)
keycloak	Not vulnerable source
unifi[6]	Mitigated #150329 #150329 #150425 #151145 #151179 #151178

The text was updated successfully, but these errors were encountered:

Fixes CVE-2021-44228 NixOS#150288

Fixes CVE-2021-44228 #150288 (cherry picked from commit be4883e)

Ma27 · 2021-12-12T20:13:18Z

Will patch pkgs.signald tonight.

Currently, the log4j update needed to mitigate CVE-2021-44228[1] is not yet part of a release, so we apply the commit[2] as patch for now. Relevant for NixOS#150288 [1] https://nvd.nist.gov/vuln/detail/CVE-2021-44228 [2] https://gitlab.com/signald/signald/-/commit/7f668062ab9ffa09a49d171e995f57cf0a0803a7

Equivalent to 79ab6a8 on `master`, but against 0.14.1. Relevant for NixOS#150288

wamserma · 2021-12-13T13:22:10Z

Would it be possible to hook a scanner like https://github.com/mergebase/log4j-detector into some postInstall-Hook for all packages depending on JDK? Or maybe directly into Hydra?

Fixes CVE-2021-44228. See NixOS#150288.

bryanasdev000 · 2021-12-14T07:17:28Z

As soon as a new release of Jmeter is released, I'm going to update it.

Fixes CVE-2021-44228. See #150288. (cherry picked from commit d2d9d4c)

aanderse · 2021-12-14T12:05:23Z

I added a note on how to mitigate the attack for solr.

ius · 2021-12-14T23:45:37Z

Note that the Log4J maintainers have made additional releases (2.16.0 and 2.12.2) which are now listed as the fix for CVE-2021-44228 (instead of 2.15).

It fixes a (less severe) denial of service (CVE-2021-45046) and disables JNDI by default.

Most downstream consumers will probably make yet another release...

talyz · 2021-12-15T15:53:16Z

I'm working on updating ELK 7 and should have a PR ready soon.

Fixes CVE-2021-45105 (NixOS#150288)

Fixes CVE-2021-44228 and CVE-2021-45046 (NixOS#150288).

Upgrade bundled log4j to 2.12.3 (NixOS#150288)

lorenzleutgeb · 2021-12-22T17:22:18Z

Related MRs:

`gradle`

`pdftk`

pdftk: 3.3.1 -> 3.3.2 #151791

bryanasdev000 · 2021-12-26T02:48:58Z

Another PR for Jmeter:

#152176

Moredread · 2021-12-26T17:38:52Z

mediathekview might be affected.

See PR #152261

Fixes CVE-2021-45105 (#150288) (cherry picked from commit 2654041)

Fixes CVE-2021-44228 #150288

Tungsten842 · 2021-12-30T09:18:56Z

@ius @antono @auntie @robberer @bjornfor @bergey A new version of arduino with log4j fixes has been released

Tungsten842 · 2021-12-30T09:24:11Z

@ius @mimame A new version with fixes for log4j has been released for igv too.

Fixes CVE-2021-44228 and CVE-2021-45046 (#150288). (cherry picked from commit 63840ce)

asbachb · 2022-07-24T08:06:03Z

Can we close this issue or is there any open task?

bryanasdev000 · 2022-07-26T04:13:10Z

Can we close this issue or is there any open task?

From a quick look seems that Solr is the main one missing.

ius · 2022-07-27T19:13:04Z

Let's close this. Packages should either be patched by now, otherwise they're likely to be orphaned and suffer from other issues as well.

In case of Solr it looks like it has plenty of vulnerability tags slapped onto it.

Equivalent to 79ab6a8 on `master`, but against 0.14.1. Relevant for NixOS#150288 # Conflicts: # pkgs/applications/networking/instant-messengers/signald/default.nix

ius added 0.kind: bug Something is broken 1.severity: security Issues which raise a security issue, or PRs that fix one labels Dec 11, 2021

ius added a commit to ius/nixpkgs that referenced this issue Dec 11, 2021

zap: 2.11.0 -> 2.11.1

be4883e

Fixes CVE-2021-44228 NixOS#150288

This was referenced Dec 11, 2021

zap: 2.11.0 -> 2.11.1 #150289

Merged

[21.05] zap: 2.10.0 -> 2.11.1 #150295

Merged

zhaofengli mentioned this issue Dec 11, 2021

unifi6: 6.5.53 -> 6.5.54, nixos/unifi: Apply log4j2 mitigation #150329

Merged

13 tasks

github-actions bot pushed a commit that referenced this issue Dec 12, 2021

zap: 2.11.0 -> 2.11.1

d7e0ee3

Fixes CVE-2021-44228 #150288 (cherry picked from commit be4883e)

mweinelt pinned this issue Dec 12, 2021

This was referenced Dec 12, 2021

[backport release-21.11] unifi6: 6.5.53 -> 6.5.54, nixos/unifi: Apply log4j2 mitigation #150425

Merged

[backport release-21.05] nixos/unifi: Apply log4j2 mitigation #150426

Merged

Ma27 mentioned this issue Dec 12, 2021

signald: incorporate log4j update for CVE-2021-44228 #150479

Merged

13 tasks

Ma27 added a commit to Ma27/nixpkgs that referenced this issue Dec 13, 2021

signald: incorporate log4j update for CVE-2021-44228

6e7ff9d

Equivalent to 79ab6a8 on `master`, but against 0.14.1. Relevant for NixOS#150288

Ma27 mentioned this issue Dec 13, 2021

[21.11] signald: incorporate log4j update for CVE-2021-44228 #150523

Merged

13 tasks

Ma27 added a commit to Ma27/nixpkgs that referenced this issue Dec 13, 2021

signald: incorporate log4j update for CVE-2021-44228

39a70b1

Equivalent to 79ab6a8 on `master`, but against 0.14.1. Relevant for NixOS#150288

Ma27 mentioned this issue Dec 13, 2021

[21.05] signald: incorporate log4j update for CVE-2021-44228 #150526

Merged

13 tasks

0x4A6F mentioned this issue Dec 13, 2021

graylog: 3.3.14 -> 3.3.15 #150511

Merged

13 tasks

ius added a commit to ius/nixpkgs that referenced this issue Dec 13, 2021

apache-jena: 4.2.0 -> 4.3.1; apache-jena-fuseki: 4.2.0 -> 4.3.1

d2d9d4c

Fixes CVE-2021-44228. See NixOS#150288.

github-actions bot pushed a commit that referenced this issue Dec 14, 2021

apache-jena: 4.2.0 -> 4.3.1; apache-jena-fuseki: 4.2.0 -> 4.3.1

794c484

Fixes CVE-2021-44228. See #150288. (cherry picked from commit d2d9d4c)

talyz mentioned this issue Dec 15, 2021

elk7: 7.11.1 -> 7.16.1, 6.8.3 -> 6.8.21 + add filebeat module and tests #150879

Merged

13 tasks

ius added a commit to ius/nixpkgs that referenced this issue Dec 22, 2021

ghidra: 10.1 -> 10.1.1

2654041

Fixes CVE-2021-45105 (NixOS#150288)

ius mentioned this issue Dec 22, 2021

ghidra: 10.1 -> 10.1.1 #151768

Merged

13 tasks

ius added a commit to ius/nixpkgs that referenced this issue Dec 22, 2021

flink: 1.14.0 -> 1.14.2

63840ce

Fixes CVE-2021-44228 and CVE-2021-45046 (NixOS#150288).

ius mentioned this issue Dec 22, 2021

flink: 1.14.0 -> 1.14.2 #151776

Merged

13 tasks

ius added a commit to ius/nixpkgs that referenced this issue Dec 22, 2021

ghidra: fix CVE-2021-45046, CVE-2021-45105

7759198

Upgrade bundled log4j to 2.12.3 (NixOS#150288)

github-actions bot pushed a commit that referenced this issue Dec 27, 2021

ghidra: 10.1 -> 10.1.1

40ded2b

Fixes CVE-2021-45105 (#150288) (cherry picked from commit 2654041)

risicle pushed a commit that referenced this issue Dec 28, 2021

zap: 2.11.0 -> 2.11.1

a4d8be7

Fixes CVE-2021-44228 #150288

Stunkymonkey mentioned this issue Jan 27, 2022

arduino: 1.8.16 -> 1.8.19 #157025

Merged

13 tasks

github-actions bot pushed a commit that referenced this issue Jan 30, 2022

flink: 1.14.0 -> 1.14.2

5c52604

Fixes CVE-2021-44228 and CVE-2021-45046 (#150288). (cherry picked from commit 63840ce)

veprbl unpinned this issue Feb 3, 2022

This was referenced Feb 19, 2022

[21.05] tsm-client: 8.1.8.0 -> 8.1.13.3 (security update) #150591

Merged

[21.11] tsm-client: 8.1.8.0 -> 8.1.13.3 (security update) #150590

Merged

solr: 8.6.3 -> 8.9.0 #120556

Closed

solr: 8.6.3 -> 8.11.1 #161875

Closed

ius closed this as completed Jul 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2021-44228 (Apache log4j) tracking issue #150288

CVE-2021-44228 (Apache log4j) tracking issue #150288

ius commented Dec 11, 2021 •

edited

Loading

Ma27 commented Dec 12, 2021

wamserma commented Dec 13, 2021 •

edited

Loading

bryanasdev000 commented Dec 14, 2021

aanderse commented Dec 14, 2021

ius commented Dec 14, 2021

talyz commented Dec 15, 2021

lorenzleutgeb commented Dec 22, 2021

bryanasdev000 commented Dec 26, 2021

Moredread commented Dec 26, 2021 •

edited

Loading

Tungsten842 commented Dec 30, 2021

Tungsten842 commented Dec 30, 2021 •

edited

Loading

asbachb commented Jul 24, 2022

bryanasdev000 commented Jul 26, 2022

ius commented Jul 27, 2022

CVE-2021-44228 (Apache log4j) tracking issue #150288

CVE-2021-44228 (Apache log4j) tracking issue #150288

Comments

ius commented Dec 11, 2021 • edited Loading

Ma27 commented Dec 12, 2021

wamserma commented Dec 13, 2021 • edited Loading

bryanasdev000 commented Dec 14, 2021

aanderse commented Dec 14, 2021

ius commented Dec 14, 2021

talyz commented Dec 15, 2021

lorenzleutgeb commented Dec 22, 2021

gradle

pdftk

bryanasdev000 commented Dec 26, 2021

Moredread commented Dec 26, 2021 • edited Loading

Tungsten842 commented Dec 30, 2021

Tungsten842 commented Dec 30, 2021 • edited Loading

asbachb commented Jul 24, 2022

bryanasdev000 commented Jul 26, 2022

ius commented Jul 27, 2022

ius commented Dec 11, 2021 •

edited

Loading

wamserma commented Dec 13, 2021 •

edited

Loading

`gradle`

`pdftk`

Moredread commented Dec 26, 2021 •

edited

Loading

Tungsten842 commented Dec 30, 2021 •

edited

Loading