You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by GitBox <gi...@apache.org> on 2021/12/10 17:20:08 UTC
[GitHub] [iceberg] RussellSpitzer opened a new issue #3710: CVE-2021-44228 - Log4j Remote Execution
RussellSpitzer opened a new issue #3710:
URL: https://github.com/apache/iceberg/issues/3710
https://www.randori.com/blog/cve-2021-44228/
https://github.com/apache/logging-log4j2/pull/608
Currently a few of our runtime platforms use log4j but not in an effected version but we do not actually ship or include these jars. I don't think we need to do anything here since log4j is only a transitive dependency of these provided libraries.
From what I've read danger versions are
`2.0 <= 2.14.1`
Since we mostly get our dependencies from rather old usages we general will only have `1.2.17` and again this should be marked as provided in Spark jars. Hadoop-Commons and Zookeeper bring this in as well, also at the same version for Flink.
Checking with
```
g iceberg-spark:iceberg-spark-3:dependencyInsight --dependency log4j --configuration compileClasspath
g iceberg-flink:iceberg-flink-1.13:dependencyInsight --dependency log4j --configuration compileClasspath
```
So double check your frameworks are safe but it looks like Iceberg as a project shouldn't need any changes atm.
If anyone has other concerns please leave them below
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jzhuge commented on issue #3710: CVE-2021-44228 - Log4j Remote Execution
Posted by GitBox <gi...@apache.org>.
jzhuge commented on issue #3710:
URL: https://github.com/apache/iceberg/issues/3710#issuecomment-991410490
Found log4j-core 2.11.2 in `zinc` configuration. Probably ok?
```
$ ./gradlew :iceberg-spark:iceberg-spark-extensions-3.2_2.12:dependencyInsight --dependency org.apache.logging.log4j:log4j-core --configuration zinc
> Task :iceberg-spark:iceberg-spark-extensions-3.2_2.12:dependencyInsight
org.apache.logging.log4j:log4j-core:2.11.2
variant "runtime" [
org.gradle.status = release (not requested)
org.gradle.usage = java-runtime (not requested)
org.gradle.libraryelements = jar (not requested)
org.gradle.category = library (not requested)
]
org.apache.logging.log4j:log4j-core:2.11.2
\--- org.scala-sbt:util-logging_2.12:1.3.0
+--- org.scala-sbt:zinc-core_2.12:1.3.5
| +--- org.scala-sbt:zinc_2.12:1.3.5
| | \--- zinc
| \--- org.scala-sbt:zinc-persist_2.12:1.3.5
| \--- org.scala-sbt:zinc_2.12:1.3.5 (*)
+--- org.scala-sbt:zinc-compile-core_2.12:1.3.5
| \--- org.scala-sbt:zinc_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-classfile_2.12:1.3.5
+--- org.scala-sbt:zinc_2.12:1.3.5 (*)
+--- org.scala-sbt:zinc-compile-core_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-apiinfo_2.12:1.3.5
+--- org.scala-sbt:zinc-core_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-compile-core_2.12:1.3.5 (*)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] jzhuge commented on issue #3710: CVE-2021-44228 - Log4j Remote Execution
Posted by GitBox <gi...@apache.org>.
jzhuge commented on issue #3710:
URL: https://github.com/apache/iceberg/issues/3710#issuecomment-991410490
Found log4j-core 2.11.2 in `zinc` configuration. Probably ok?
```
$ ./gradlew :iceberg-spark:iceberg-spark-extensions-3.2_2.12:dependencyInsight --dependency org.apache.logging.log4j:log4j-core --configuration zinc
> Task :iceberg-spark:iceberg-spark-extensions-3.2_2.12:dependencyInsight
org.apache.logging.log4j:log4j-core:2.11.2
variant "runtime" [
org.gradle.status = release (not requested)
org.gradle.usage = java-runtime (not requested)
org.gradle.libraryelements = jar (not requested)
org.gradle.category = library (not requested)
]
org.apache.logging.log4j:log4j-core:2.11.2
\--- org.scala-sbt:util-logging_2.12:1.3.0
+--- org.scala-sbt:zinc-core_2.12:1.3.5
| +--- org.scala-sbt:zinc_2.12:1.3.5
| | \--- zinc
| \--- org.scala-sbt:zinc-persist_2.12:1.3.5
| \--- org.scala-sbt:zinc_2.12:1.3.5 (*)
+--- org.scala-sbt:zinc-compile-core_2.12:1.3.5
| \--- org.scala-sbt:zinc_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-classfile_2.12:1.3.5
+--- org.scala-sbt:zinc_2.12:1.3.5 (*)
+--- org.scala-sbt:zinc-compile-core_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-apiinfo_2.12:1.3.5
+--- org.scala-sbt:zinc-core_2.12:1.3.5 (*)
\--- org.scala-sbt:zinc-compile-core_2.12:1.3.5 (*)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] RussellSpitzer commented on issue #3710: CVE-2021-44228 - Log4j Remote Execution
Posted by GitBox <gi...@apache.org>.
RussellSpitzer commented on issue #3710:
URL: https://github.com/apache/iceberg/issues/3710#issuecomment-991634962
@jzhuge I think that would only be an issue for folks running CI and using Zinc for incremental compilation if that internal compilation service can receive a request via some outside source and get SBT to log it. So basically you have to run Gradle as a service, have gradle run zinc when you run the Scala compilation and have zinc open a port to receive external communications. As far as I know Zinc doesn't host an public services
That said we should probably upgrade Gradle whenever it has an update for the Scala plugin. I agree that this is probably ok and not a real vulnerability.
Tracking for the Zinc upgrade
https://github.com/sbt/sbt/issues/6742 - Patched in SBT
No patch in gradle yet as far as I can see (probably because no SBT release yet)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
[GitHub] [iceberg] RussellSpitzer commented on issue #3710: CVE-2021-44228 - Log4j Remote Execution
Posted by GitBox <gi...@apache.org>.
RussellSpitzer commented on issue #3710:
URL: https://github.com/apache/iceberg/issues/3710#issuecomment-991634962
@jzhuge I think that would only be an issue for folks running CI and using Zinc for incremental compilation if that internal compilation service can receive a request via some outside source and get SBT to log it. So basically you have to run Gradle as a service, have gradle run zinc when you run the Scala compilation and have zinc open a port to receive external communications. As far as I know Zinc doesn't host an public services
That said we should probably upgrade Gradle whenever it has an update for the Scala plugin. I agree that this is probably ok and not a real vulnerability.
Tracking for the Zinc upgrade
https://github.com/sbt/sbt/issues/6742 - Patched in SBT
No patch in gradle yet as far as I can see (probably because no SBT release yet)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org