Reg CVE 2021-44832

[ramkrishna vasudevan <ra...@gmail.com>]

Hi All,

We are internally using Solr 7.5. As part of the zero day log4j
vulnerability we already moved the log4j to 2.17.0 version in the solr
component.

Now the tools that we run internally flags CVE-2021-44832
<https://nvd.nist.gov/vuln/detail/CVE-2021-44832>.
But the Solr security page
https://solr.apache.org/security.html

Clearly says this vulnerability is not affected in 7.4 to 8.11.1 but the
affected components are 'log4j-core-2.14.1.jar, log4j-core-2.16.0.jar'.

So does that mean that if we are with log4j-core-2.17.0.jar then this
vulnerability needs to be fixed? Or the same argument that '*Solr's default
log configuration doesn't use JDBCAppender and we don't imagine a user
would want to use it or other obscure appenders*.'  is it valid for 2.17.0
version also?

Any info on this would be appreciated. Thanks in advance.
PS : Sorry for emailing to dev@ and user@ since I wanted to see if other
users also faced similar issues.

Regards
Ram

Re: Reg CVE 2021-44832

[ramkrishna vasudevan <ra...@gmail.com>]

Thanks a lot Shawn. I do apologize for cross posting it though. Sometimes
dev community and the PMCs are more closer to the security items hence I
did send to both. But i totally agree with you. Next time will send it to
security@ mailing list.

But your answer to this was very useful to us.

Regards
Ram

On Thu, Sep 7, 2023 at 4:49 AM Shawn Heisey <ap...@elyograg.org> wrote:

> On 9/5/23 23:10, ramkrishna vasudevan wrote:
> > Now the tools that we run internally flags CVE-2021-44832
> > <https://nvd.nist.gov/vuln/detail/CVE-2021-44832>.
>
> I did not notice that this was cross-posted to both users and dev.  I
> read dev first, replied, and then saw this message.
>
> This list (users) is the correct list for this.  Please do not
> cross-post to multiple lists.  The reason we have multiple lists is
> because each of them serves a different purpose ... it is VERY rare that
> a question will be appropriate for more than one list.  The dev list is
> for discussions around developing Solr itself, not for anything on a
> user install.
>
> You could have sent the message to the security list instead, though an
> old vulnerability like this is better handled on users.  Anyone can send
> to the security list, but only project PMC members can subscribe to it.
> The security list is mostly for disclosure of new security problems, so
> there is a private way of letting the project know about a problem that
> needs to be fixed before going public.
>
> Thanks,
> Shawn
>
>

Re: Reg CVE 2021-44832

[Shawn Heisey <ap...@elyograg.org>]

On 9/5/23 23:10, ramkrishna vasudevan wrote:
> Now the tools that we run internally flags CVE-2021-44832
> <https://nvd.nist.gov/vuln/detail/CVE-2021-44832>.

I did not notice that this was cross-posted to both users and dev.  I 
read dev first, replied, and then saw this message.

This list (users) is the correct list for this.  Please do not 
cross-post to multiple lists.  The reason we have multiple lists is 
because each of them serves a different purpose ... it is VERY rare that 
a question will be appropriate for more than one list.  The dev list is 
for discussions around developing Solr itself, not for anything on a 
user install.

You could have sent the message to the security list instead, though an 
old vulnerability like this is better handled on users.  Anyone can send 
to the security list, but only project PMC members can subscribe to it. 
The security list is mostly for disclosure of new security problems, so 
there is a private way of letting the project know about a problem that 
needs to be fixed before going public.

Thanks,
Shawn

Re: Reg CVE 2021-44832

[Shawn Heisey <ap...@elyograg.org>]

On 9/5/23 23:10, ramkrishna vasudevan wrote:
> Clearly says this vulnerability is not affected in 7.4 to 8.11.1 but the
> affected components are 'log4j-core-2.14.1.jar, log4j-core-2.16.0.jar'.
> 
> So does that mean that if we are with log4j-core-2.17.0.jar then this
> vulnerability needs to be fixed? Or the same argument that '*Solr's default
> log configuration doesn't use JDBCAppender and we don't imagine a user
> would want to use it or other obscure appenders*.'  is it valid for 2.17.0
> version also?

You can only be affected if you have changed the logging config in your 
Solr install to use JDBCAppender.  Solr's default logging config does 
NOT use that appender.

You could upgrade all the log4j jars in Solr to 2.17.2 and then your 
vulnerability scanner should not find that vulnerability.

It MIGHT be safe to update the log4j jars to 2.20.0, the latest release, 
but I can't guarantee that.  Updating to 2.17.2 would be safe.  I have 
done that without problems.

Thanks,
Shawn


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@solr.apache.org
For additional commands, e-mail: dev-help@solr.apache.org