Fix Apache Log4j2 remote code Execution Vulnerability (CNVD-2021-95914)

View mode

You can check whether the Log4j vulnerability needs to be fixed in your environment by using the following methods:

• View source code

  Log4j may have indirect dependencies. Therefore, you cannot determine the version from the POM. You can run the following command on the project root directory to view the version of Log4j:

  mvn compile dependency:tree -Dincludes=org.apache.logging.log4j

  View the version of log4j in the output. For example, the following version is 2.12.1:

  [INFO] org.example:Demo1:jar:1.0-SNAPSHOT
  [INFO] \- org.apache.logging.log4j:log4j-core:jar:2.12.1:compile
  [INFO]    \- org.apache.logging.log4j:log4j-api:jar:2.12.1:compile

• View the JAR package on the server

  You can view the JAR package of the project server to check whether it depends on the log4j-core:

  ls /home/admin/release/run/target/boot/*/BOOT-INF/lib/ | grep log4j-core

  The /home/admin/release/run/target/boot/* is the path of the JAR package. You need to modify the path based on your project.

Repair solution

You can use one of the following methods to fix the Log4j vulnerability. If you have sufficient time, we recommend that you upgrade the log4j-core version to fix the vulnerability.

• Upgrade the log4j-core version

  You can add the following content to the dependencyManagement of the outermost pom:

  <dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>${version}</version>
  </dependency>

  The following versions of the vulnerability are fixed:

  Note

  To resolve the compatibility issue between different versions, Ant Group provides the following nonelookup2 version. You can use the nonelookup2 version as needed.

  • 2.6.2_nonelookup2

  • 2.7_nonelookup2

  • 2.8_nonelookup2

  • 2.8.1_nonelookup2

  • 2.8.2_nonelookup2

  • 2.9.0_nonelookup2

  • 2.9.1_nonelookup2

  • 2.10.0_nonelookup2

  • 2.11.0_nonelookup2

  • 2.11.1_nonelookup2

  • 2.11.2_nonelookup2

  • 2.12.0_nonelookup2

  • 2.12.1_nonelookup2

  • 2.13.0_nonelookup2

  • 2.13.1_nonelookup2

  • 2.13.2_nonelookup2

  • 2.13.3_nonelookup2

  • 2.14.1_nonelookup2

  Example:

  <dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.6.2_nonelookup2</version>
  </dependency>

• Removing log4j-core dependencies

  If you do not use the log4j logging framework, but rely on log4j-core. After you find the dependency path, you can add the following content to the dependency of the dependency log4j-core:

  <exclusions>
       <exclusion>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-core</artifactId>
       </exclusion>
  </exclusions>

• The lookup function that blocks the problem

  If you are using the log4j-core 2.10.0 version or later, you can add -Dlog4j2.formatMsgNoLookups=true configurations to the Java startup parameters to prevent the lookup feature from causing problems.

Problem fix confirmation

• Dependency confirmation

  Check whether the dependencies are valid. For more information, see View dependencies.

• Confirmation of Repair Effect

  Try to use the command to print logs. If the printed information is, it is as expected. If it is a real date, the configuration does not take effect.

  Important

  Check whether the log contains usage ${}. If so, we recommend that you change the log output format.