You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@druid.apache.org by Eyal Yurman <ey...@yahooinc.com.INVALID> on 2021/12/10 18:03:00 UTC
Log4j vulnerability - hotfix?
Hello, regarding https://github.com/apache/druid/pull/12051 which merged to
master,
Is it a common practice for the project to backport and release a new minor
for the latest version?
Re: [E] Re: Log4j vulnerability - hotfix?
Posted by Jihoon Son <ji...@apache.org>.
I started a release vote an hour ago. If you want to use the patched
version soon, please help with reviewing the release :)
On Fri, Dec 10, 2021 at 12:22 PM Eyal Yurman <ey...@yahooinc.com.invalid>
wrote:
> Thank you for the fast response.
>
> On Fri, Dec 10, 2021 at 11:35 AM Gian Merlino <gi...@apache.org> wrote:
>
> > We're working on this right now and will be getting a vote / release for
> > 0.22.1 out asap.
> >
> > Btw, the log4j announcement mentions a mitigation that does work for our
> > current version (2.8.2). It's part (b) here, specifying "%m{nolookups}"
> in
> > the PatternLayout configuration:
> >
> >
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.apache.org_thread_bfnl1stql187jytr0t5k0hv0go6b76g4&d=DwIFaQ&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=SuBO953fsmU44ZHE0kwkYBIV-hvc-I5wqLvTFRA4RyA&m=gSJrS9K_MvHCpvyQVGe6FxHPFR1dN56YiTbzDAVkNqc&s=qpDSWATFc6fc441gjKMF6hgdvcZJKCTNltN5EolGlwo&e=
> > . However,
> > I haven't personally tested this, so I cannot provide any more details
> > beyond pointing to the announcement.
> >
> > On Fri, Dec 10, 2021 at 10:27 AM Lucas Capistrant <
> > capistrant.lucas@gmail.com> wrote:
> >
> > > Since it is “critical” severity, I think it would be a good idea to
> > > seriously consider pushing out a minor version of 0.22.x. Especially
> > since
> > > the mitigation strategy outlined in the CVE is not available in the
> log4j
> > > version that exists today in the current stable release. There is past
> > > precedent for such releases: see 0.20.2
> > >
> > > On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <eyurman14@yahooinc.com
> > > .invalid>
> > > wrote:
> > >
> > > > Hello, regarding
> >
> https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_apache_druid_pull_12051&d=DwIFaQ&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=SuBO953fsmU44ZHE0kwkYBIV-hvc-I5wqLvTFRA4RyA&m=gSJrS9K_MvHCpvyQVGe6FxHPFR1dN56YiTbzDAVkNqc&s=WGWSrb1gDnt3pidi5VPE0ibY1jS_KC7J9n56Bm7YPOU&e=
> > which merged
> > > > to
> > > > master,
> > > >
> > > > Is it a common practice for the project to backport and release a new
> > > minor
> > > > for the latest version?
> > > >
> > >
> >
>
Re: [E] Re: Log4j vulnerability - hotfix?
Posted by Eyal Yurman <ey...@yahooinc.com.INVALID>.
Thank you for the fast response.
On Fri, Dec 10, 2021 at 11:35 AM Gian Merlino <gi...@apache.org> wrote:
> We're working on this right now and will be getting a vote / release for
> 0.22.1 out asap.
>
> Btw, the log4j announcement mentions a mitigation that does work for our
> current version (2.8.2). It's part (b) here, specifying "%m{nolookups}" in
> the PatternLayout configuration:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.apache.org_thread_bfnl1stql187jytr0t5k0hv0go6b76g4&d=DwIFaQ&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=SuBO953fsmU44ZHE0kwkYBIV-hvc-I5wqLvTFRA4RyA&m=gSJrS9K_MvHCpvyQVGe6FxHPFR1dN56YiTbzDAVkNqc&s=qpDSWATFc6fc441gjKMF6hgdvcZJKCTNltN5EolGlwo&e=
> . However,
> I haven't personally tested this, so I cannot provide any more details
> beyond pointing to the announcement.
>
> On Fri, Dec 10, 2021 at 10:27 AM Lucas Capistrant <
> capistrant.lucas@gmail.com> wrote:
>
> > Since it is “critical” severity, I think it would be a good idea to
> > seriously consider pushing out a minor version of 0.22.x. Especially
> since
> > the mitigation strategy outlined in the CVE is not available in the log4j
> > version that exists today in the current stable release. There is past
> > precedent for such releases: see 0.20.2
> >
> > On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <eyurman14@yahooinc.com
> > .invalid>
> > wrote:
> >
> > > Hello, regarding
> https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_apache_druid_pull_12051&d=DwIFaQ&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=SuBO953fsmU44ZHE0kwkYBIV-hvc-I5wqLvTFRA4RyA&m=gSJrS9K_MvHCpvyQVGe6FxHPFR1dN56YiTbzDAVkNqc&s=WGWSrb1gDnt3pidi5VPE0ibY1jS_KC7J9n56Bm7YPOU&e=
> which merged
> > > to
> > > master,
> > >
> > > Is it a common practice for the project to backport and release a new
> > minor
> > > for the latest version?
> > >
> >
>
Re: Log4j vulnerability - hotfix?
Posted by Gian Merlino <gi...@apache.org>.
Hi David,
Right now we are very much dedicating our efforts to getting a 0.22.1 patch
release out. It's taking longer than we'd hoped due to an unexpected issue
with the upgrade to log4j 2.15.0: https://github.com/apache/druid/pull/12056
.
Based on the testing we've done so far, though, I think there's another
mitigation available to you if you want to stay on 0.21: you could drop in
the 5 new log4j2 2.15.0 jars to lib/, remove the 2.8.2 jars, and add
-Dlog4j2.is.webapp=false to your jvm command line. The new jars will fix
the vulnerability and the jvm config avoids the error on shutdown.
On Fri, Dec 10, 2021 at 2:35 PM David Glasser <gl...@apollographql.com>
wrote:
> I will note that the `%m{nolookups}` workaround feels a lot more
> challenging to feel comfortable using than the `-D`/env var
> workarounds that work in the newer versions. For example, our
> log4j2.xml file has two Appenders, one of which uses JsonLayout and
> one of which uses PatternLayout. It's hard to understand from the docs
> as a non-log4j-expert if the JsonLayout appender is vulnerable or not
> and if there's a way to apply `%m{nolookups}` to it.
>
> Because the workarounds for Druid are more challenging than for
> projects on the slightly newer versions of log4j2, perhaps it would be
> appropriate to put out one or two more patch releases, against 0.21
> and/or 0.20? I know our installation is still on 0.21, which is less
> than 2 months old.
>
> On Fri, Dec 10, 2021 at 11:35 AM Gian Merlino <gi...@apache.org> wrote:
> >
> > We're working on this right now and will be getting a vote / release for
> > 0.22.1 out asap.
> >
> > Btw, the log4j announcement mentions a mitigation that does work for our
> > current version (2.8.2). It's part (b) here, specifying "%m{nolookups}"
> in
> > the PatternLayout configuration:
> > https://lists.apache.org/thread/bfnl1stql187jytr0t5k0hv0go6b76g4.
> However,
> > I haven't personally tested this, so I cannot provide any more details
> > beyond pointing to the announcement.
> >
> > On Fri, Dec 10, 2021 at 10:27 AM Lucas Capistrant <
> > capistrant.lucas@gmail.com> wrote:
> >
> > > Since it is “critical” severity, I think it would be a good idea to
> > > seriously consider pushing out a minor version of 0.22.x. Especially
> since
> > > the mitigation strategy outlined in the CVE is not available in the
> log4j
> > > version that exists today in the current stable release. There is past
> > > precedent for such releases: see 0.20.2
> > >
> > > On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <eyurman14@yahooinc.com
> > > .invalid>
> > > wrote:
> > >
> > > > Hello, regarding https://github.com/apache/druid/pull/12051 which
> merged
> > > > to
> > > > master,
> > > >
> > > > Is it a common practice for the project to backport and release a new
> > > minor
> > > > for the latest version?
> > > >
> > >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@druid.apache.org
> For additional commands, e-mail: dev-help@druid.apache.org
>
>
Re: Log4j vulnerability - hotfix?
Posted by David Glasser <gl...@apollographql.com>.
I will note that the `%m{nolookups}` workaround feels a lot more
challenging to feel comfortable using than the `-D`/env var
workarounds that work in the newer versions. For example, our
log4j2.xml file has two Appenders, one of which uses JsonLayout and
one of which uses PatternLayout. It's hard to understand from the docs
as a non-log4j-expert if the JsonLayout appender is vulnerable or not
and if there's a way to apply `%m{nolookups}` to it.
Because the workarounds for Druid are more challenging than for
projects on the slightly newer versions of log4j2, perhaps it would be
appropriate to put out one or two more patch releases, against 0.21
and/or 0.20? I know our installation is still on 0.21, which is less
than 2 months old.
On Fri, Dec 10, 2021 at 11:35 AM Gian Merlino <gi...@apache.org> wrote:
>
> We're working on this right now and will be getting a vote / release for
> 0.22.1 out asap.
>
> Btw, the log4j announcement mentions a mitigation that does work for our
> current version (2.8.2). It's part (b) here, specifying "%m{nolookups}" in
> the PatternLayout configuration:
> https://lists.apache.org/thread/bfnl1stql187jytr0t5k0hv0go6b76g4. However,
> I haven't personally tested this, so I cannot provide any more details
> beyond pointing to the announcement.
>
> On Fri, Dec 10, 2021 at 10:27 AM Lucas Capistrant <
> capistrant.lucas@gmail.com> wrote:
>
> > Since it is “critical” severity, I think it would be a good idea to
> > seriously consider pushing out a minor version of 0.22.x. Especially since
> > the mitigation strategy outlined in the CVE is not available in the log4j
> > version that exists today in the current stable release. There is past
> > precedent for such releases: see 0.20.2
> >
> > On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <eyurman14@yahooinc.com
> > .invalid>
> > wrote:
> >
> > > Hello, regarding https://github.com/apache/druid/pull/12051 which merged
> > > to
> > > master,
> > >
> > > Is it a common practice for the project to backport and release a new
> > minor
> > > for the latest version?
> > >
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@druid.apache.org
For additional commands, e-mail: dev-help@druid.apache.org
Re: Log4j vulnerability - hotfix?
Posted by Gian Merlino <gi...@apache.org>.
We're working on this right now and will be getting a vote / release for
0.22.1 out asap.
Btw, the log4j announcement mentions a mitigation that does work for our
current version (2.8.2). It's part (b) here, specifying "%m{nolookups}" in
the PatternLayout configuration:
https://lists.apache.org/thread/bfnl1stql187jytr0t5k0hv0go6b76g4. However,
I haven't personally tested this, so I cannot provide any more details
beyond pointing to the announcement.
On Fri, Dec 10, 2021 at 10:27 AM Lucas Capistrant <
capistrant.lucas@gmail.com> wrote:
> Since it is “critical” severity, I think it would be a good idea to
> seriously consider pushing out a minor version of 0.22.x. Especially since
> the mitigation strategy outlined in the CVE is not available in the log4j
> version that exists today in the current stable release. There is past
> precedent for such releases: see 0.20.2
>
> On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <eyurman14@yahooinc.com
> .invalid>
> wrote:
>
> > Hello, regarding https://github.com/apache/druid/pull/12051 which merged
> > to
> > master,
> >
> > Is it a common practice for the project to backport and release a new
> minor
> > for the latest version?
> >
>
Re: Log4j vulnerability - hotfix?
Posted by Lucas Capistrant <ca...@gmail.com>.
Since it is “critical” severity, I think it would be a good idea to
seriously consider pushing out a minor version of 0.22.x. Especially since
the mitigation strategy outlined in the CVE is not available in the log4j
version that exists today in the current stable release. There is past
precedent for such releases: see 0.20.2
On Fri, Dec 10, 2021 at 12:14 PM Eyal Yurman <ey...@yahooinc.com.invalid>
wrote:
> Hello, regarding https://github.com/apache/druid/pull/12051 which merged
> to
> master,
>
> Is it a common practice for the project to backport and release a new minor
> for the latest version?
>
Re: Log4j vulnerability - hotfix?
Posted by Jihoon Son <ji...@apache.org>.
Hi Eyal,
Yes. As this vulnerability seems critical, we are working on the 0.22.1.
release.
On Fri, Dec 10, 2021 at 10:14 AM Eyal Yurman <ey...@yahooinc.com.invalid>
wrote:
> Hello, regarding https://github.com/apache/druid/pull/12051 which merged
> to
> master,
>
> Is it a common practice for the project to backport and release a new minor
> for the latest version?
>