Log4j vulnerability CVE-2021-44228
Monday, 13 December 2021 · 5 messages
MC
Marc Coenegracht13 Dec 2021 16:11 #
Does Basex (9.x or 8.x) use Log4j in any of its components?
If not, should one still worry about the JRE?
Regards,
Marc
CG
Christian Grün13 Dec 2021 16:18 #
Hi Marc,
I was waiting for that question ;)
All fine, BaseX uses a custom logger, as well as Jetty does [1,2].
You may need to check your setup, though, if you use Tomcat as web server or any additional search index applications like Solr or Elasticsearch. ES is only susceptible to information leak, not remote code execution [3].
Hope this helps,
Christian
[1] https://docs.basex.org/wiki/Logging
[2] https://docs.huihoo.com/jetty/the-definitive-reference/configuring-logging.html [3] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476
Quoted text · Marc Coenegracht · 8 lines
On Mon, Dec 13, 2021 at 4:11 PM Marc Coenegracht <marc at crosseyed.nl> wrote: > > Does Basex (9.x or 8.x) use Log4j in any of its components? > If not, should one still worry about the JRE? > > > Regards, > Marc
MC
Marc Coenegracht13 Dec 2021 17:12 #
Hi Christian,
So you already knew :)
Very glad to read your answer, the exploitation attempts are already showing up in the logs.
thanks, this helps a lot,
Marc
Quoted text · Christian Grün · 30 lines
On Mon, 13 Dec 2021, Christian Grün wrote: > Hi Marc, > > I was waiting for that question ;) > > All fine, BaseX uses a custom logger, as well as Jetty does [1,2]. > > You may need to check your setup, though, if you use Tomcat as web > server or any additional search index applications like Solr or > Elasticsearch. ES is only susceptible to information leak, not remote > code execution [3]. > > Hope this helps, > Christian > > [1] https://docs.basex.org/wiki/Logging > [2] https://docs.huihoo.com/jetty/the-definitive-reference/configuring-logging.html > [3] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476 > > > > On Mon, Dec 13, 2021 at 4:11 PM Marc Coenegracht <marc at crosseyed.nl> wrote: > > > > Does Basex (9.x or 8.x) use Log4j in any of its components? > > If not, should one still worry about the JRE? > > > > > > Regards, > > Marc >
CG
Quoted text · Jonathan Robie · 1 line
> Waiting smugly, I gather ;->
;) mostly because my last two days were completely taken up with client and user requests on log4j.
A blog article on Open Source software and commercial users, worth reading:
https://blog.filippo.io/professional-maintainers/
Jonathan Robie <jonathan.robie at gmail.com> schrieb am Mo., 13. Dez. 2021, 19:08:
Quoted text · Jonathan Robie · 11 lines
> > > On Mon, Dec 13, 2021 at 10:18 AM Christian Grün <christian.gruen at gmail.com> > wrote: > >> I was waiting for that question ;) >> > > > Jonathan >
JR
Quoted text · Christian Grün · 4 lines
On Mon, Dec 13, 2021 at 10:18 AM Christian Grün <christian.gruen at gmail.com> wrote: > I was waiting for that question ;) >
Waiting smugly, I gather ;->
Jonathan
Written for BaseX 9.6. BaseX may have changed since: please check the current documentation.
⚡Generated with XQuery