Home Original page

0-Day RCE in log4j, present in at least one package

Comment by loqs (loqs) - Saturday, 11 December 2021, 20:14 GMT

Comment by Justin Kromlinger (hashworks) - Sunday, 12 December 2021, 13:33 GMT

Regarding elasticsearch: I've implemented the linked patch in 7.10.2-2. It replaces `/usr/share/elasticsearch/lib/log4j-core-2.11.1.jar` with `elasticsearch-log4j-7.10.2.jar`, which doesn't include the `JndiLookup.class`:
```
old/org/apache/logging/log4j/core/util/JndiCloser.class
old/org/apache/logging/log4j/core/selector/JndiContextSelector.class
old/org/apache/logging/log4j/core/net/JndiManager$JndiManagerFactory.class
old/org/apache/logging/log4j/core/net/JndiManager$1.class
old/org/apache/logging/log4j/core/net/JndiManager.class
old/org/apache/logging/log4j/core/lookup/JndiLookup.class <-----
new/org/apache/logging/log4j/core/util/JndiCloser.class
new/org/apache/logging/log4j/core/selector/JndiContextSelector.class
new/org/apache/logging/log4j/core/net/JndiManager.class
new/org/apache/logging/log4j/core/net/JndiManager$JndiManagerFactory.class
new/org/apache/logging/log4j/core/net/JndiManager$1.class
```

Comment by freswa (frederik) - Sunday, 12 December 2021, 14:09 GMT

ghidra is fixed with 10.1 in [community]

Comment by David Runge (dvzrv) - Sunday, 12 December 2021, 14:51 GMT

solr is fixed with 8.11.0-2 in [community]

Comment by Massimiliano Torromeo (mtorromeo) - Sunday, 12 December 2021, 16:47 GMT

logstash patched in 7.10.2-1

Comment by Massimiliano Torromeo (mtorromeo) - Sunday, 12 December 2021, 16:52 GMT

openfire updated to 4.6.5 which already uses log4j 2.15.0

Loading...