1 、以数据之名 简介
- 微信公众号、知乎和稀土掘金等,主体均为“以数据之名”;
- 本文主要针对近期Apache Log4j 5连环漏洞,做修复策略实践经验总结。
2 、Log4j 漏洞综述
【安全通告-高危】Apache Log4j 五连环安全漏洞 |
【综述】近日,监测到Apache Log4j 存在多个任意代码执行及DoS拒绝漏洞: CVE-2021-4104:Apache Log4j 1.2.x版本在特定配置时存在JMSAppender 反序列化代码执行漏洞。 CVE-2021-44228:该组件存在Java JNDI 注入漏洞,当程序将用户输入的数据进行日志,即可触发此漏洞,成功利用此漏洞可以在目标服务器上执行任意代码。 CVE-2021-45046:当log4j配置使用非默认模式布局和上下文查找(例如$${ctx:loginId})或线程上下文映射模式(%X、%mdc或%MDC)时,使用JNDI查找模式制作恶意输入数据从而导致拒绝服务(DoS) 攻击。 CVE-2021-45105:由于log4j没有防止在自引用查找中不受控制的递归,当日志配置使用带有上下文查找的非默认模式布局(例如,$${ctx:loginId})时,控制线程上下文映射 (MDC) 输入数据的攻击者可以制作包含递归查找的恶意输入数据,导致 StackOverflowError 终止进程,造成DoS攻击。 CVE-2021-44832:在某些特殊场景下(如系统采用动态加载远程配置文件的场景等),有权修改日志配置文件的攻击者可以构建恶意配置,通过JDBC Appender 引用JNDI URI 数据源触发JNDI 注入,成功利用此漏洞可以实现远程代码执行。 |
【影响范围】 CVE-2021-44228: 2.0-beta9 <= Apache Log4j <= 2.12.1 2.13.0<= Apache Log4j <= 2.15.0-rc1 CVE-2021-45046: 2.0-beta9 <= Apache Log4j <= 2.12.1 2.13.0<= Apache Log4j <= 2.15.0-rc2(2.15.0稳定版) 注:只有 log4j-core jar文件受此漏洞影响。 CVE-2021-4104: Apache Log4j =1.2.x CVE-2021-45105: 2.0-alpha1 <= Apache Log4j <=2.16.0 注:只有 log4j-core jar文件受此漏洞影响。 CVE-2021-44832: 2.0-beta7 <= Apache Log4j2 <= 2.17.0 注:不包括安全修复版本2.3.2 和2.12.4 |
【漏洞影响】攻击者可利用上述漏洞,成功在目标服务器上执行任意代码及发起拒绝攻击。 |
【处置建议】升级至: Apache Log4j 2.17.1(适用于java8) Apache Log4j 2.12.4(适用于java7) Apache Log4j 2.3.2 (适用于java6) 注:此漏洞在特殊情况下才会被利用,建议已升级至2.17.0 、2.12.3的,在下次有上线的时候升级掉,还未升级的升级至以上最新版本。 |
【处置时间】建议30天内修复完成 |
3 、Log4j 依赖 Jdk 版本
3.1 Jdk 1.6 应用
Log4j 版本 | 修复状态 | 备注 |
---|---|---|
2.0.x~2.3 | 未修复 | |
2.3.2 | 已修复 | 推荐 Jdk1.6 版本的应用,升级到该版本 |
3.2 Jdk 1.7 应用
Log4j 版本 | 修复状态 | 备注 |
---|---|---|
2.4~2.12.1 | 未修复 | |
2.12.2 | 未完全修复 | 已修复JNDI漏洞,其他未修复 |
2.12.3 | 未完全修复 | 已基本修复,但不完全 |
2.12.4 | 已修复 | 推荐 Jdk1.7 版本的应用,升级到该版本 |
3.3 Jdk 1.8 应用
Log4j 版本 | 修复状态 | 备注 |
---|---|---|
2.13.0~2.14.1 | 未修复 | |
2.15.0 | 未完全修复 | 已修复JNDI漏洞,其他未修复 |
2.16.0 | 未完全修复 | 已修复JNDI漏洞和Lookup漏洞,其他未修复 |
2.17.0 | 已修复 | 修复MDC递归循环依赖漏洞 |
2.17.1 | 已修复 | 推荐 Jdk1.8 版本的应用,升级到该版本 |
4 、Jdk 1.8 应用升级
4.1 Maven 依赖替换
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jcl</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.25</version>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>com.lmax</groupId>
<artifactId>disruptor</artifactId>
<version>3.4.2</version>
</dependency>
</dependencies>
4.2 Ivy 依赖替换
<dependencies>
<dependency org="org.apache.logging.log4j" name="log4j-api" conf="zip->default" rev="2.17.1" />
<dependency org="org.apache.logging.log4j" name="log4j-core" conf="zip->default" rev="2.17.1" />
<dependency org="org.apache.logging.log4j" name="log4j-1.2-api" conf="zip->default" rev="2.17.1" />
<dependency org="org.apache.logging.log4j" name="log4j-jcl" conf="zip->default" rev="2.17.1" />
<dependency org="org.apache.logging.log4j" name="log4j-jul" conf="zip->default" rev="2.17.1" />
<dependency org="org.apache.logging.log4j" name="log4j-slf4j-impl" conf="zip->default" rev="2.17.1" />
<dependency org="org.slf4j" name="slf4j-api" conf="zip->default" rev="1.7.25" />
<dependency org="commons-logging" name="commons-logging" conf="zip->default" rev="1.2" />
<dependency org="com.lmax" name="disruptor" conf="zip->default" rev="3.4.2" />
</dependencies>
5 、非 Jdk 1.8 应用升级
5.1 jdk 1.7 maven依赖替换
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jcl</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
<version>2.12.4</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.25</version>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>com.lmax</groupId>
<artifactId>disruptor</artifactId>
<version>3.4.2</version>
</dependency>
</dependencies>
5.2 jdk 1.6 maven依赖替换
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jcl</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.25</version>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>com.lmax</groupId>
<artifactId>disruptor</artifactId>
<version>3.3.2</version>
</dependency>
</dependencies>
6 、Log4j 漏洞修复其他问题
6.1 com.lmax的disruptor的版本兼容性问题
- Log4j 的2.12.2和2.16.0版本选用disruptor-3.4.2版本。
- Log4j 的2.3版本选用disruptor-3.3.2版本。
6.2 DocumentBuilderFactory.setFeature找不到的问题
引入如下依赖,并且删除其他xerces的包,保留如下包即可
<dependencies>
<dependency>
<groupId>xerces</groupId>
<artifactId>xerceslmpl</artifactId>
<version>2.12.1</version>
</dependency>
<dependency>
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
<version>1.4.01</version>
</dependency>
</dependencies>
6.3 Invalid byte tag in constant pool: 19异常
此异常是Tomcat版本低的原因,可以升级Tomcat8版本。对应用可用性无影响。解决SEVERE: Unable to process Jar entry [module-info.class] from Jar [jar:file:/opt/oracle/tomcat/webapps/app-sys/WEB-INF/lib/jackson-annotations.jar!/] for annotations org.apache.tomcat.util.bcel.classfile.ClassFormatException: Invalid byte tag in constant pool: 19
解决方案:更新Tomcat
最新版本是2.2,默认运行7.0.47。另一方面,Maven Central显示撰写本文时的最新版本是 7.0.86。这就是我们想要的版本。
pom.xml如下:
<project>
<properties>
<tomcat.version>7.0.86</tomcat.version>
</properties>
<plugins>
<plugin>
<groupId>org.apache.tomcat.maven</groupId>
<artifactId>tomcat7-maven-plugin</artifactId>
<version>2.2</version>
<configuration>
<path>/</path>
<port>7777</port>
</configuration>
<dependencies>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-util</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-coyote</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-api</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-jdbc</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-dbcp</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-servlet-api</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-jsp-api</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-jasper</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-jasper-el</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-el-api</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-tribes</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina-ha</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-annotations-api</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-juli</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-logging-juli</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-logging-log4j</artifactId>
<version>${tomcat.version}</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</project>