You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by fr...@apache.org on 2024/08/27 20:36:58 UTC
(logging-site) branch Feature/threat-model created (now a487419f)
This is an automated email from the ASF dual-hosted git repository.
freeandnil pushed a change to branch Feature/threat-model
in repository https://gitbox.apache.org/repos/asf/logging-site.git
at a487419f splitted threat model for log4j and log4net
This branch includes the following new commits:
new dbb15f13 rename to log4net
new a487419f splitted threat model for log4j and log4net
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(logging-site) 02/02: splitted threat model for log4j and log4net
Posted by fr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
freeandnil pushed a commit to branch Feature/threat-model
in repository https://gitbox.apache.org/repos/asf/logging-site.git
commit a487419f74d73bcd8b2d546e95e4c4d0c56621c0
Author: Jan Friedrich <fr...@apache.org>
AuthorDate: Tue Aug 27 22:36:21 2024 +0200
splitted threat model for log4j and log4net
---
_threat-model-log4j.adoc | 23 +++++++++++++++++++
_threat-model-log4net.adoc | 56 ++++++++++++++++++++++++++++++++++++----------
security.adoc | 4 ++--
3 files changed, 69 insertions(+), 14 deletions(-)
diff --git a/_threat-model-log4j.adoc b/_threat-model-log4j.adoc
index 08a123b9..615c738a 100644
--- a/_threat-model-log4j.adoc
+++ b/_threat-model-log4j.adoc
@@ -20,6 +20,29 @@
Below we share the threat model specific to link:/log4j[Log4j].
+[#threat-log4j-code-signing]
+==== Code signing
+
+All Logging Services software release distributions are signed using GPG using a key from the Logging Services PMC https://downloads.apache.org/logging/KEYS[KEYS file].
+Information on how to verify releases signatures are explained further in xref:download.adoc[the Download page].
+Thus, GPG signatures should be validated in your build process.
+
+[#threat-log4j-config-sources]
+==== Configuration sources
+All configuration sources to an application must be trusted by the programmer.
+When loading a configuration file from disk (especially when a monitor interval is configured to reload the file periodically), the location of the configuration file must be kept safe from unauthorized modifications.
+Similarly, when loading a configuration file over the network such as through HTTP, this should be configured to use TLS or a secure connection in general with strong authentication guarantees.
+This remote location must be kept safe from unauthorized modifications.
+When configurations are modified through JMX, the JMX server should be safely configured to require authentication and a secure connection if being accessed over the network.
+When configurations are provided through JNDI, these should only use the `java` scheme for sharing configurations in a Java EE or Jakarta EE application service.
+JNDI-sourced configurations should not use other JNDI providers such as LDAP, DNS, or RMI, as all these providers are difficult to properly secure.
+
+[#threat-log4j-java-serialization]
+==== Java Object Serialization Stream Protocol
+
+https://docs.oracle.com/javase/8/docs/platform/serialization/spec/protocol.html[Java Object Serialization Stream Protocol] should not be used to deserialize data from untrusted sources.
+See https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data[the related OWASP guide] for details.
+
[#threat-log4j-parametrized-logging]
==== Parameterized logging
diff --git a/_threat-model-log4net.adoc b/_threat-model-log4net.adoc
index 1e08f2f5..8ad65185 100644
--- a/_threat-model-log4net.adoc
+++ b/_threat-model-log4net.adoc
@@ -15,30 +15,62 @@
limitations under the License.
////
-[#threat-common]
-=== Common threat model
+[#threat-log4net]
+=== Log4Net threat model
-Below we share the threat model shared by all Logging Services projects.
+Below we share the threat model specific to link:/log4net[log4net].
-[#threat-common-code-signing]
+[#threat-log4net-code-signing]
==== Code signing
All Logging Services software release distributions are signed using GPG using a key from the Logging Services PMC https://downloads.apache.org/logging/KEYS[KEYS file].
Information on how to verify releases signatures are explained further in xref:download.adoc[the Download page].
Thus, GPG signatures should be validated in your build process.
-[#threat-common-config-sources]
+[#threat-log4net-config-sources]
==== Configuration sources
All configuration sources to an application must be trusted by the programmer.
When loading a configuration file from disk (especially when a monitor interval is configured to reload the file periodically), the location of the configuration file must be kept safe from unauthorized modifications.
Similarly, when loading a configuration file over the network such as through HTTP, this should be configured to use TLS or a secure connection in general with strong authentication guarantees.
This remote location must be kept safe from unauthorized modifications.
-When configurations are modified through JMX, the JMX server should be safely configured to require authentication and a secure connection if being accessed over the network.
-When configurations are provided through JNDI, these should only use the `java` scheme for sharing configurations in a Java EE or Jakarta EE application service.
-JNDI-sourced configurations should not use other JNDI providers such as LDAP, DNS, or RMI, as all these providers are difficult to properly secure.
-[#threat-common-java-serialization]
-==== Java Object Serialization Stream Protocol
+[#threat-log4net-parametrized-logging]
+==== Parameterized logging
-https://docs.oracle.com/javase/8/docs/platform/serialization/spec/protocol.html[Java Object Serialization Stream Protocol] should not be used to deserialize data from untrusted sources.
-See https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data[the related OWASP guide] for details.
+When using a log message containing template parameters like `{0}`, only the format string is evaluated for parameters to be substituted.
+The message parameters themselves are not evaluated for parameters; they are only included in the format string corresponding to their template position.
+The conversion of message parameters into a string is done on-demand depending on the layout being used.
+When structure-preserving transformations of log message data are required, the `Message` API should be used for logging structured data combined with a structured layout (e.g., `XmlLayout`).
+Format strings should be compile-time constants, and under no circumstances should format strings be built using user-controlled input data.
+
+[#threat-log4net-unstructured-logging]
+==== Unstructured logging
+
+When using an unstructured layout such as `PatternLayout`, no guarantees can be made about the output format.
+This layout is mainly useful for development purposes and should not be relied on in production applications.
+For example, if a log message contains new lines, these are not escaped or encoded.
+As such, when using unstructured layouts, no user-controlled input should be included in logs.
+It is strongly recommended that a structured layout (e.g., `XmlLayout`) is used instead for these situations.
+
+[#threat-log4net-structured-logging]
+==== Structured logging
+
+When using a structured layout (most layouts besides pattern layout), log messages are encoded according to various output formats.
+These safely encode the various fields included in a log message.
+For example, the `XmlLayout` can be used to output log messages in an XML structure where all log data is properly encoded into safely parseable XML.
+This is the recommended mode of operation for use with log parsing and log collection tools that rely on log files or arbitrary output streams.
+
+[#threat-log4net-log-masking]
+==== Log masking
+
+Log4Net, like any other generic logging library, cannot generically support log masking of sensitive data.
+While custom plugins may be developed to attempt to mask various regular expressions (such as a string that looks like a credit card number), the general problem of log masking is equivalent to the halting problem in computer science where sensitive data can always be obfuscated in such a way as to avoid detection by log masking.
+As such, it is the responsibility of the developer to properly demarcate sensitive data such that it can be consistently masked by log masking plugins.
+This sort of use case should make use of the `Message` API for better control over the output of such data.
+
+[#threat-log4net-availability]
+==== Availability
+
+Log4Net goes to great lengths to minimize performance overhead along with options for minimizing latency or maximizing throughput.
+However, we cannot guarantee availability of the application if the appenders cannot keep up with the logs being written.
+Logging can cause applications to block and wait for a log message to be written.
\ No newline at end of file
diff --git a/security.adoc b/security.adoc
index b0127485..d29b6e52 100644
--- a/security.adoc
+++ b/security.adoc
@@ -47,10 +47,10 @@ We urge you to **carefully read the threat model** detailed in following section
It guides users on certain safety instructions while using Logging Services software and elaborates on what counts as an unexpected behaviour that has a security impact.
====
-include::_threat-model-common.adoc[]
-
include::_threat-model-log4j.adoc[]
+include::_threat-model-log4net.adoc[]
+
[#policy]
== Vulnerability handling policy
(logging-site) 01/02: rename to log4net
Posted by fr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
freeandnil pushed a commit to branch Feature/threat-model
in repository https://gitbox.apache.org/repos/asf/logging-site.git
commit dbb15f13a94a04aff4950824ac7157f3f96c09c9
Author: Jan Friedrich <fr...@apache.org>
AuthorDate: Tue Aug 27 22:22:00 2024 +0200
rename to log4net
---
_threat-model-common.adoc => _threat-model-log4net.adoc | 0
1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/_threat-model-common.adoc b/_threat-model-log4net.adoc
similarity index 100%
rename from _threat-model-common.adoc
rename to _threat-model-log4net.adoc