log4j2漏洞修复出现 EMPTY_BYTE_ARRAY

最新推荐文章于 2024-06-25 08:00:00 发布

ziyunmumu

最新推荐文章于 2024-06-25 08:00:00 发布

阅读量8.9k

点赞数 5

分类专栏：工具文章标签： java jar apache

本文链接：https://blog.csdn.net/ziyunmuxu/article/details/121950756

版权

工具专栏收录该内容

3 篇文章 0 订阅

订阅专栏

最近Apache Log4j2出现了“核弹级”漏洞，其中针对jdk8以上的修复方案常见为，将log4j-core升级为2.15.0版本；
升级后应用出现：java.lang.NoSuchFieldError: EMPTY_BYTE_ARRAY报错，具体堆栈信息如下

java.lang.NoSuchFieldError: EMPTY_BYTE_ARRAY
    at org.apache.logging.log4j.core.config.ConfigurationSource.<clinit>(ConfigurationSource.java:56)
    at org.apache.logging.log4j.core.config.DefaultConfiguration.<init>(DefaultConfiguration.java:46)
    at org.apache.logging.log4j.core.layout.PatternLayout$Builder.build(PatternLayout.java:768)
    at net.bull.javamelody.Log4J2Appender.<clinit>(Log4J2Appender.java:46)
    at net.bull.javamelody.FilterContext.initLogs(FilterContext.java:318)
    at net.bull.javamelody.FilterContext.<init>(FilterContext.java:95)
    at net.bull.javamelody.MonitoringFilter.init(MonitoringFilter.java:142)
    at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:281)
    at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:110)
    at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4554)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5197)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1412)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1402)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
18:31:09.706 ERROR [ost-startStop-1][] o.a.catalina.core.StandardContext - One or more Filters failed

后面将log4j-api同步升级后，未出现该ERROR报错

建议log4j2修复漏洞方案为，同时升级log4j-core和log4j-api

<dependency>
	<groupId>org.apache.logging.log4j</groupId>
	<artifactId>log4j-core</artifactId>
	<version>2.15.0</version>
</dependency>
<dependency>
	<groupId>org.apache.logging.log4j</groupId>
	<artifactId>log4j-api</artifactId>
	<version>2.15.0</version>
</dependency>