You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@kylin.apache.org by Yaqian Zhang <Ya...@126.com> on 2021/12/10 10:56:40 UTC
[Kylin Security Notice] Impact analysis of Apache Log4j2 Remote Code Execution Vulnerability
Hi all:
This is a security notice about the impact analysis of Apache Log4j2 Remote Code Execution Vulnerability on Apache Kylin.
Background
Apache Log4j2 is a Java based logging tool, which is widely used in the industry. The recently discovered Remote Code Execution Vulnerability of Apache Log4j2 makes it possible for the program that introduces Apache Log4j2 to be triggered Remote Code Execution by an attacker who construct a special request.
Scope of influence
The version range of Log4j2 with security vulnerabilities is: Apache Log4j 2.x <= 2.14.1.
The currently released versions of Apache Kylin (Kylin 2.x, Kylin 3.x, Kylin 4.x) use log4j version 1.2.17 by default. However, considering that kylin's startup script will load jars from Hadoop environment, including Hadoop, Spark, HBase, Hive and other components, the log4j version used in Hadoop3 environment is generally Apache Log4j2, so if your Hadoop is above version 3.0, it is recommended to upgrade the Log4j2 of Hadoop cluster, to avoid the possibility of polluting kylin services.
Solution
If the Hadoop component used by kylin user's environment uses Log4j2, the user needs to comprehensively upgrade Log4j2 to the latest 2.15.0-rc2 to prevent Kylin from loading the jar of Log4j2 with security risks into Kylin's classpath through scripts.
After the log4j2 environment is fully upgraded, users can execute jinfo `cat pid` under $KYLIN_HOME to check whether the jar packages such as log4j-core-2.x.x.jar introduced by Kylin's classpath are the latest secure Log4j2 versions.
Best Regards!
Apache Kylin Team
Re: [Kylin Security Notice] Impact analysis of Apache Log4j2 Remote Code Execution Vulnerability
Posted by ShaoFeng Shi <sh...@apache.org>.
Yaqian, thank you for the information!
Best regards,
Shaofeng Shi 史少锋
Apache Kylin PMC,
Apache Incubator PMC,
Email: shaofengshi@apache.org
Apache Kylin FAQ: https://kylin.apache.org/docs/gettingstarted/faq.html
Join Kylin user mail group: user-subscribe@kylin.apache.org
Join Kylin dev mail group: dev-subscribe@kylin.apache.org
Yaqian Zhang <Ya...@126.com> 于2021年12月10日周五 18:58写道：
> Hi all:
>
> This is a security notice about the impact analysis of Apache Log4j2
> Remote Code Execution Vulnerability on Apache Kylin.
> Background
>
> Apache Log4j2 is a Java based logging tool, which is widely used in the
> industry. The recently discovered Remote Code Execution Vulnerability of
> Apache Log4j2 makes it possible for the program that introduces Apache
> Log4j2 to be triggered Remote Code Execution by an attacker who construct a
> special request.
> Scope of influence
>
> The version range of Log4j2 with security vulnerabilities is: Apache Log4j
> 2.x <= 2.14.1.
> The currently released versions of Apache Kylin (Kylin 2.x, Kylin 3.x,
> Kylin 4.x) use log4j version 1.2.17 by default. However, considering that
> kylin's startup script will load jars from Hadoop environment, including
> Hadoop, Spark, HBase, Hive and other components, the log4j version used in
> Hadoop3 environment is generally Apache Log4j2, so if your Hadoop is above
> version 3.0, it is recommended to upgrade the Log4j2 of Hadoop cluster, to
> avoid the possibility of polluting kylin services.
> Solution
>
> If the Hadoop component used by kylin user's environment uses Log4j2, the
> user needs to comprehensively upgrade Log4j2 to the latest 2.15.0-rc2 to
> prevent Kylin from loading the jar of Log4j2 with security risks into
> Kylin's classpath through scripts.
> After the log4j2 environment is fully upgraded, users can execute jinfo
> `cat pid` under $KYLIN_HOME to check whether the jar packages such as
> log4j-core-2.x.x.jar introduced by Kylin's classpath are the latest secure
> Log4j2 versions.
>
>
> Best Regards!
>
> Apache Kylin Team
Re: [Kylin Security Notice] Impact analysis of Apache Log4j2 Remote Code Execution Vulnerability
Posted by ShaoFeng Shi <sh...@apache.org>.
Yaqian, thank you for the information!
Best regards,
Shaofeng Shi 史少锋
Apache Kylin PMC,
Apache Incubator PMC,
Email: shaofengshi@apache.org
Apache Kylin FAQ: https://kylin.apache.org/docs/gettingstarted/faq.html
Join Kylin user mail group: user-subscribe@kylin.apache.org
Join Kylin dev mail group: dev-subscribe@kylin.apache.org
Yaqian Zhang <Ya...@126.com> 于2021年12月10日周五 18:58写道：
> Hi all:
>
> This is a security notice about the impact analysis of Apache Log4j2
> Remote Code Execution Vulnerability on Apache Kylin.
> Background
>
> Apache Log4j2 is a Java based logging tool, which is widely used in the
> industry. The recently discovered Remote Code Execution Vulnerability of
> Apache Log4j2 makes it possible for the program that introduces Apache
> Log4j2 to be triggered Remote Code Execution by an attacker who construct a
> special request.
> Scope of influence
>
> The version range of Log4j2 with security vulnerabilities is: Apache Log4j
> 2.x <= 2.14.1.
> The currently released versions of Apache Kylin (Kylin 2.x, Kylin 3.x,
> Kylin 4.x) use log4j version 1.2.17 by default. However, considering that
> kylin's startup script will load jars from Hadoop environment, including
> Hadoop, Spark, HBase, Hive and other components, the log4j version used in
> Hadoop3 environment is generally Apache Log4j2, so if your Hadoop is above
> version 3.0, it is recommended to upgrade the Log4j2 of Hadoop cluster, to
> avoid the possibility of polluting kylin services.
> Solution
>
> If the Hadoop component used by kylin user's environment uses Log4j2, the
> user needs to comprehensively upgrade Log4j2 to the latest 2.15.0-rc2 to
> prevent Kylin from loading the jar of Log4j2 with security risks into
> Kylin's classpath through scripts.
> After the log4j2 environment is fully upgraded, users can execute jinfo
> `cat pid` under $KYLIN_HOME to check whether the jar packages such as
> log4j-core-2.x.x.jar introduced by Kylin's classpath are the latest secure
> Log4j2 versions.
>
>
> Best Regards!
>
> Apache Kylin Team