颤抖吧 Javaer， log4j 史诗级漏洞

2021-12-10 09:16:39 +08:00
 eviladan0s

漏洞预警： https://mp.weixin.qq.com/s/WBbAthHY36qY0w9e4UUl4Q

本质上是 log4j 里的 lookup 方法存在 jndi 注入（看图）： https://adan0s-1256533472.cos.ap-nanjing.myqcloud.com/uPic/20211210091200YOXTYd.jpg

百度、谷歌、苹果的框全都沦陷了： https://adan0s-1256533472.cos.ap-nanjing.myqcloud.com/uPic/202112100913225Wncr7.png

修复措施： 在 log4j2.component.properties 配置文件中设置 log4j2.formatMsgNoLookups=true ，可以暂时缓解避免受漏洞的影响。

之所以是史诗级，是因为不仅 log4j 使用范围广，而且日志数据你不知道流到哪里的 log4j 就会触发

34549 次点击
所在节点    Java
189 条回复
mostkia
2021-12-12 14:51:02 +08:00
目前还在用 jdk8 ，依赖 java 环境的程序不多，暂时停用了相关服务。
chaigon
2021-12-12 19:56:04 +08:00
@cheng6563 slf4j 也受影响
chaigon
2021-12-12 19:56:32 +08:00
java 养活了整个安全行业
joshuacavell
2021-12-13 09:40:50 +08:00
log4j2 2.15.0-rc2 已经发布 https://github.com/apache/logging-log4j2/tree/rel/2.15.0
jwh199588
2021-12-13 10:18:15 +08:00
@sshang https://gluten.cool/journals
vanishxiaoma
2021-12-13 10:45:12 +08:00
https://logging.apache.org/log4j/2.x/

News
CVE-2021-44228
The Log4j team has been made aware of a security vulnerability, CVE-2021-44228, that has been addressed in Log4j 2.15.0.

Log4j’s JNDI support has not restricted what names could be resolved. Some protocols are unsafe or can allow remote code execution. Log4j now limits the protocols by default to only java, ldap, and ldaps and limits the ldap protocols to only accessing Java primitive objects by default served on the local host.

One vector that allowed exposure to this vulnerability was Log4j’s allowance of Lookups to appear in log messages. As of Log4j 2.15.0 this feature is now disabled by default. While an option has been provided to enable Lookups in this fashion, users are strongly discouraged from enabling it.
cheng6563
2021-12-13 10:57:54 +08:00
@chaigon slf4j 都不会解析${}这种日志有什么影响？
moooodo
2021-12-13 13:16:28 +08:00
暂时修不了的，可以用这个临时打个热补丁 https://mp.weixin.qq.com/s/ClNpWamMn55BkholbUbo_g
ptrees
2021-12-13 16:50:16 +08:00
想知道怎么彻底修复,临时的修复方案过不了安全扫描,客户不认😂

这是一个专为移动设备优化的页面（即为了让你能够在 Google 搜索结果里秒开这个页面），如果你希望参与 V2EX 社区的讨论，你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://tanronggui.xyz/t/821241

V2EX 是创意工作者们的社区，是一个分享自己正在做的有趣事物、交流想法，可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX