Bump log4j to 2.15.0

[shoothzj]

Modifications

Bump log4j to 2.15.0

Documentation

Check the box below and label this PR (if you have committer privilege).

Need to update docs?

• no-need-doc

Only need to modify the license part

[BewareMyPower]

Should we add this PR to 2.8.2 since there is a security vulnerability for log4j < 2.15? @315157973

[merlimat]

Should we add this PR to 2.8.2 since there is a security vulnerability for log4j < 2.15? @315157973

If there’s a security issue, we should also backport to 2.7

[lhotari]

Should we add this PR to 2.8.2 since there is a security vulnerability for log4j < 2.15? @315157973

@BewareMyPower which vulnerability is it? severity level?

[315157973]

which vulnerability is it? severity level

Very serious

[lhotari]

which vulnerability is it? severity level

Very serious

@315157973 I don't see any vulnerability listed here: https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j
Do you have the CVE id?

[massakam]

FYI
https://www.lunasec.io/docs/blog/log4j-zero-day/

[lhotari]

@315157973 I'll cherry pick to branch-2.8 and branch-2.7 . Since the issue is extremely severe, I think we need to expedite 2.8.2 and 2.7.4 releases. /cc @michaeljmarshall

[imryao]

which vulnerability is it? severity level

Very serious

@315157973 I don't see any vulnerability listed here: https://ossindex.sonatype.org/component/pkg:maven/org.apache.logging.log4j/log4j Do you have the CVE id?

CVE-2021-44228
you can check it here
GHSA-jfh8-c2jp-5v3q

[lhotari]

I also cherry-picked to branch-2.6 . I think it would make sense to do a 2.6.5 release since CVE-2021-44228 is such a severe issue. @merlimat @eolivelli @massakam WDYT?

[lhotari]

The workaround seems to be to set log4j2.formatMsgNoLookups to true.
reference: https://twitter.com/80vul/status/1468968891489857537

[lhotari]

I can confirm that JVM system property -Dlog4j2.formatMsgNoLookups=true prevents the issue. This workaround applies for Log4j >= 2.10.0 . I'm working on a Pulsar Helm Chart change that passes that automatically for all Pulsar processes.

[lhotari]

CVE-2021-44228 is triggered if user provided input is passed to Logger's debug/info/warn/error method directly. It doesn't get triggered if user provided input is logged using {} placeholders. This reduces the likelyhood of the exploit quite a lot .

[lhotari]

workaround in Pulsar Helm Chart by setting -Dlog4j2.formatMsgNoLookups=true : apache/pulsar-helm-chart#186

[lhotari]

CVE-2021-44228 is triggered if user provided input is passed to Logger's debug/info/warn/error method directly. It doesn't get triggered if user provided input is logged using {} placeholders. This reduces the likelyhood of the exploit quite a lot .

It seems that using {} placeholders isn't sufficient: https://twitter.com/CZ_JanecekPetr/status/1469220756580179972 . The only confirmed workaround is -Dlog4j2.formatMsgNoLookups=true .

[liangyuanpeng]

Thanks for your work.