You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by rg...@apache.org on 2021/12/11 16:32:53 UTC
[logging-log4j2] branch master updated: Add changes manually made to the web site
This is an automated email from the ASF dual-hosted git repository.
rgoers pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
The following commit(s) were added to refs/heads/master by this push:
new 3a5836b Add changes manually made to the web site
3a5836b is described below
commit 3a5836b9404e3e6605f75a8c0c2907c4691e4870
Author: Ralph Goers <rg...@apache.org>
AuthorDate: Sat Dec 11 09:32:34 2021 -0700
Add changes manually made to the web site
---
src/changes/changes.xml | 4 +++-
src/site/asciidoc/manual/layouts.adoc | 4 ++++
src/site/asciidoc/security.adoc | 28 ++++++++++++++++++++++++++++
3 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index fbb0196..ef63c65 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -168,7 +168,9 @@
Fixes incorrect constructor call in LocalizedMessageFactory.
</action>
</release>
- <release version="2.15.0" date="2021-MM-DD" description="GA Release 2.15.0">
+ <release version="2.15.1" date="2021-12-XX" description="GA Release 2.15.0">
+ </release>
+ <release version="2.15.0" date="2021-12-06" description="GA Release 2.15.0">
<!-- ADDS -->
<action issue="LOG4J2-3198" dev="ckozak" type="add">
Pattern layout no longer enables lookups within message text by default for cleaner API boundaries and reduced
diff --git a/src/site/asciidoc/manual/layouts.adoc b/src/site/asciidoc/manual/layouts.adoc
index 54d9039..6f40d44 100644
--- a/src/site/asciidoc/manual/layouts.adoc
+++ b/src/site/asciidoc/manual/layouts.adoc
@@ -1289,6 +1289,10 @@ with an actual date. This can be confusing in many cases, and it's often both ea
more obvious to handle the lookup in code.
This feature is disabled by default and the message string is logged untouched.
+*Note:* Users are *STRONGLY* discouraged from using the lookups option. Doing so may allow uncontrolled user input
+containing lookups to take unintended actions. In almost all cases the software developer can accomplish the same tasks
+lookups perform directly in the application code.
+
|[[PatternMethod]] *M* +
*method*
|Outputs the method name where the logging request was issued.
diff --git a/src/site/asciidoc/security.adoc b/src/site/asciidoc/security.adoc
index 6eab1fa..7a6d022 100644
--- a/src/site/asciidoc/security.adoc
+++ b/src/site/asciidoc/security.adoc
@@ -44,6 +44,34 @@ If you have encountered an unlisted security vulnerability or other unexpected b
that has security impact, or if the descriptions here are incomplete, please report them
privately to the mailto:private@logging.apache.org[Log4j Security Team]. Thank you.
+### Fixed in Log4j 2.15.0
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228[CVE-2021-4422]: Apache Log4j2 JNDI
+features do not protect against attacker controlled LDAP and other JNDI related endpoints.
+
+Severity: Critical
+
+Base CVSS Score: 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+
+Versions Affected: all versions from 2.0-beta9 to 2.14.1
+
+Descripton: Apache Log4j2 <= 2.14.1 JNDI features used in configuration, log messages, and parameters do not
+protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log
+messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup
+substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default.
+
+Mitigation: In releases >= 2.10, this behavior can be mitigated by setting either the system property
+`log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
+For releases from 2.7 through 2.14.1 all PatternLayout patterns can be modified to specify the message converter as
+`%m{nnolookups}` instead of just `%m`.
+For releases from 2.0-beta9 to 2.7, the only mitigation is to remove the `JndiLookup` class from the classpath:
+`zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`.
+
+Credit: This issue was discovered by Chen Zhaojun of Alibaba Cloud Security Team.
+
+References: https://issues.apache.org/jira/browse/LOG4J2-3201[https://issues.apache.org/jira/browse/LOG4J2-3201]
+and https://issues.apache.org/jira/browse/LOG4J2-3198[https://issues.apache.org/jira/browse/LOG4J2-3198].
+
### Fixed in Log4j 2.13.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9488[CVE-2020-9488]: