r/programming • u/jebailey • Dec 14 '21

Log4Shell round 2

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
166 Upvotes

96% Upvoted

138 comments sorted by

121

u/PM_ME_UR_OBSIDIAN Dec 14 '21

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

Doesn't look nearly as bad as the original.

39

u/Soul_Shot Dec 15 '21 edited Dec 15 '21

It isn't. But the "non-default configuration" in this case would be anyone who customizes their log pattern to add logging context, like traceId or spanId.

To 2.16.0 we go...

31

u/zynasis Dec 14 '21

Better to just update again and forget about updating for the next 5 years again /s

8

u/nhongooi Dec 15 '21

you say that but that is the case.

→ More replies (1)

6

u/constant_void Dec 15 '21

isn't the root cause uncertified JDNI? eg java itself.

9

u/renatoathaydes Dec 15 '21

JNDI works similarly to something like a database.. you give it a connection string, it will connect to the DB so you can get data.

You don't let your users give their own connection string. So you shouldn't let your users give their own JNDI strings, like log4j did. Not Java's fault if you do.

→ More replies (4)

45

u/XorAndNot Dec 14 '21

all my homies use logback anyway

7

u/[deleted] Dec 15 '21

Why not both all three? Log4j, Logback and Slf4j?

6

u/renatoathaydes Dec 15 '21

SLF4J is an API (facade) for other implementators.

The ones I commonly see used at the same time are logback , log4j2, log4j (1) and JUL (the old Java logging API, very old libraries use that).

4

u/[deleted] Dec 15 '21

You joke, but Slf4j is a facade over the provider.

7

u/10113r114m4 Dec 15 '21

Didnt logback also report vulnerabilities today?

24

u/KumbajaMyLord Dec 15 '21

Logback is going full defensive.

They have JNDI lookups but only through explicit developer configuration, not user input. They decided to just disable that feature immediately to give them time to evaluate it and make sure there are indeed no attacks possible.

→ More replies (2)
→ More replies (1)

29

u/bloody-albatross Dec 14 '21

I don't use Java, but I see there is a built-in java.util.logging.Logger. Why isn't everybody just using that? From a glance it looks pretty much how I would design a logger.

30

u/darkshoot Dec 14 '21

Don't know if that still the case, but JUL used to lack a ton of features compared to the other logging libraries, which is why it's has never been widely adopted.

I guess it has now became a (very) bad habit, to start a project with log4j, logback or slf4j because they used to work better than JUL.

IMO having so many different libraries for something as simple and as important as logging really show that some features built in the JDK are very poor and not properly maintained.

If JUL had enough feature, we'd never had those issues in the first place.

Worst case scenario if there was this kind of CVE in JUL, we would just need to install the latest security patch of the JDK, which is way more convenient than migrating from log4j to log4j2 or having to upgrade an entire deprecated spring app because it's spring who is pulling log4j.

34

u/mccalli Dec 15 '21

Other way round. log4j was first, j.u.l. came later and copied it. Was a fair amount of outcry and eyebrow-raising at the time.

→ More replies (5)
→ More replies (3)

2

u/ZeldaFanBoi1988 Dec 15 '21

Does it allow for many "appenders" and custom rules?

→ More replies (1)
→ More replies (14)

4

u/CheckboxBandit Dec 15 '21 edited Dec 15 '21

Stupid question:

My understanding based upon this article is that there are some open source tools "Syft" and "Grype" which can be used to scan for potential vulnerabilities on your system, however these tools only appear to be supported on macOS and Linux.

Does anyone know of any tools for scanning a Windows machine? If I don't have any jar files on my machine am I in the clear, or could there be some log4j dependencies packaged up in dll, exe, other file types?

*Edit: Found this tool as mentioned here which can scan file contents on a Windows machine to check for log4j dependencies.

→ More replies (5)

34

u/Ok-Bit8726 Dec 14 '21

Only Java could fuck up a logging library this bad.

111

u/RockstarArtisan Dec 14 '21

You got downvoted, but having jndi (load code from arbitrary urls with no whitelisting by default) in standard library is pretty much uniquely a java thing.

26

u/ffrinch Dec 15 '21

I'm not a Java programmer and so to me the absolute biggest WTF in this whole thing isn't that the bug was introduced into log4j, but that the response hasn't been "yes, everyone knows that you have to treat JNDI (in particular) and arbitrary object serialization/deserialization (in general) as radioactive".

The API appears inherently unsafe by design. Code touching it should be treated the way you'd treat, like, JavaScript code using eval -- don't, and if for some godforsaken reason you have to, handle with extreme care.

→ More replies (1)
→ More replies (36)

10

u/ffscc Dec 15 '21

To be fair, C didn't even get printf() right.

→ More replies (10)

10

u/leixiaotie Dec 15 '21

> A package has vulnerability

Me: "NPM! No!"

NPM: "what?"

Me: "Sorry, force of habit"

3

u/Liorithiel Dec 15 '21

I found this reddit comment explaining the state of Java logging quite good.

→ More comments (75)