[STORM-3814] storm-core: Remediate log4j critical vulnerabilities -> 2.16.0 or newer, prefer 2.17.1

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 1.2.3, 2.3.0
• Component/s: storm-core
• Assignee: Unassigned
• Reporter: Franco Luong
• Created: 03/Jan/22 16:14
• Updated: 03/Jan/22 16:27
• Resolved: 03/Jan/22 16:22

Description

• https://logging.apache.org/log4j/2.x/security.html

 

In order to remediate these bugs with Log4j, please update Storm 2.3.0 and 1.2.3 

• Criticals
  • Fixed in Log4j 2.16.0 (Java 8) and Log4j 2.12.2 (Java 7)
    • CVE-2021-45046: Apache Log4j2 Thread Context Lookup Pattern vulnerable to remote code execution in certain non-default configurations
  • Fixed in Log4j 2.15.0 (Java 8)
    • CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.
• Moderates
  • Fixed in Log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6)
    • CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration.
  • Fixed in Log4j 2.17.0 (Java 8), 2.12.3 (Java 7) and 2.3.1 (Java 6)
    • CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

 

Issue Links

• Blocked: STORM-3810 CVE-2021-44228 Log4J vulnerability