| Summary: | log4j12 new security issues CVE-2019-17571, CVE-2021-4104, and CVE-2022-2330[257] | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | All Packagers <pkg-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | release_blocker | CC: | geiger.david68210, mageia, smelror, yvesbrungard |
| Version: | Cauldron | ||
| Target Milestone: | Mageia 9 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8TOO | ||
| Source RPM: | euclide-0.6.6-8.mga8.src.rpm, eclipse-cdt-9.11.1-1.mga8.src.rpm, vstar-2.18.0-3.mga8.src.rpm, davmail-5.5.1-1.mga8.src.rpm, jitsi-2.10.5550-10.mga8.src.rpm, geometria-3.2-0.r258.9.mga8.src.rpm | CVE: | |
| Status comment: | Several packages bundling potentially vulnerable log4j 1.2.x | ||
| Bug Depends on: | |||
| Bug Blocks: | 30163 | ||
|
Description
David Walser
2021-12-16 19:14:22 CET
David Walser
2021-12-16 19:14:48 CET
Whiteboard:
(none) =>
MGA8TOO No reference to log4j12 as an independant pkg/srpm; the only indirect reference I could find for it was:
$ urpmf log4j12
davmail:/usr/share/davmail/lib/slf4j-log4j12-1.7.25.jar
which agrees with DavidW, but his list is much more extensive:-
euclide: nobody
eclipse-cdt: [neoclust], various
vstar: [joequant], nobody
davmail: kekepower
jitsi: daviddavid
geometria: nobody
Assigning this globally (CC'ing those packagers with identifiable relevance);
but in the light of:
> log4j 1.2.x is vulnerable to other CVEs, so really these packages
> just should not be continuing to use it.
> this kind of bundling is against our packaging policies,
> so we should do something about it if we can
it looks good for discussion on the packager mailList.CC:
(none) =>
geiger.david68210, smelror openSUSE has issued an advisory for this today (December 17): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U355AEBE4AWYTPUPBMC3XAO6XBTWFRBL/ jitsi embeds release 1.2.17 of the log4j.jar https://github.com/jitsi/jitsi/tree/master/lib/bundle For vstar, the jar is in 1.2.9 and comes from cobertura 1.9.3. https://sourceforge.net/p/vstar/code/HEAD/tree/tags/DEV-AAVSO-02Sep2016/extlib/cobertura-1.9.3/lib/ CC:
(none) =>
yves.brungard_mageia For euclide: 1.2.15 https://sourceforge.net/p/jeuclide/code/HEAD/tree/trunk/lib/ For geometria : 1.2.14 https://github.com/stelian56/geometria/tree/master/archive/3.2/lib/jar Euclide and geometria seems dead upstream (2014 and 2018 last activity). So they should be dropped completely in cauldron. It's hard to believe they aren't all dead if they're still using 1.2.x. Priority:
Normal =>
release_blocker RedHat has issued an advisory for this on December 20: https://access.redhat.com/errata/RHSA-2021:5206 Fix applied was: https://git.centos.org/rpms/log4j/c/33cff61a2fcde5901b8802b4a3184b906dc4b8fe?branch=c7 Ubuntu has issued an advisory for this on January 12: https://ubuntu.com/security/notices/USN-5223-1 Apache has issued advisories today (January 18): https://www.openwall.com/lists/oss-security/2022/01/18/3 https://www.openwall.com/lists/oss-security/2022/01/18/4 https://www.openwall.com/lists/oss-security/2022/01/18/5 The first two issues affect non-default configurations, but the third looks to be a more general issue. Continued usage of Log4j 1.2.x appears to be unsafe. Summary:
log4j12 new security issue CVE-2021-4104 =>
log4j12 new security issues CVE-2021-4104 and CVE-2022-2330[257] SUSE has issued an advisory for the new CVEs on January 26: https://lists.suse.com/pipermail/sle-security-updates/2022-January/010085.html Debian-LTS has issued an advisory for this on January 31: https://www.debian.org/lts/security/2022/dla-2905 RedHat has issued an advisory for this today (February 7): https://access.redhat.com/errata/RHSA-2022:0442 Ubuntu has issued an advisory for this on April 5: https://ubuntu.com/security/notices/USN-5998-1 Any packages still bundling log4j 1.x should be dropped. Summary:
log4j12 new security issues CVE-2021-4104 and CVE-2022-2330[257] =>
log4j12 new security issues CVE-2019-17571, CVE-2021-4104, and CVE-2022-2330[257] i removed davmail. There is no log4j 1.2 package anymore CC:
(none) =>
mageia |