[Bug 2030945] New: log4j: apache-log4j: Remote code execution in log4j when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Bug ID: 2030945
           Summary: log4j: apache-log4j:  Remote code execution in log4j
                    when logs contain an attacker-controlled string value.
                    [fedora-all]
           Product: Fedora
           Version: 35
            Status: NEW
         Component: log4j
          Keywords: Security, SecurityTracking
          Severity: high
          Priority: high
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]
  Target Milestone: ---
    Classification: Fedora

This is an automatically created tracking bug!  It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.

For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.

For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs

When submitting as an update, use the fedpkg template provided in the next
comment(s).  This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.

Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.

NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time.  If you need to fix the versions independent of each other,
you may clone this bug as appropriate.

[Bug 2030945] log4j: apache-log4j: Remote code execution in log4j when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #1 from Huzaifa S. Sidhpurwala  ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# low, medium, high, urgent (required)
severity=high

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=2030932,2030945

# Description of your update
notes=Security fix for [PUT CVEs HERE]

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi web interface to submit updates:

https://bodhi.fedoraproject.org/updates/new

[Bug 2030945] log4j: apache-log4j: Remote code execution in log4j when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Huzaifa S. Sidhpurwala  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |2030932

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2030932
[Bug 2030932] apache-log4j:  Remote code execution in log4j when logs contain
an attacker-controlled string value.

[Bug 2030945] log4j: log4j-core: Remote code execution in Log4j 2 when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|log4j: apache-log4j:        |log4j: log4j-core:  Remote
                   |Remote code execution in    |code execution in Log4j 2
                   |log4j when logs contain an  |when logs contain an
                   |attacker-controlled string  |attacker-controlled string
                   |value. [fedora-all]         |value. [fedora-all]

[Bug 2030945] log4j: log4j-core: Remote code execution in Log4j 2 when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Huzaifa S. Sidhpurwala  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|high                        |urgent

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2 when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Huzaifa S. Sidhpurwala  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|log4j: log4j-core:  Remote  |CVE-2021-44228 log4j:
                   |code execution in Log4j 2   |log4j-core:  Remote code
                   |when logs contain an        |execution in Log4j 2 when
                   |attacker-controlled string  |logs contain an
                   |value. [fedora-all]         |attacker-controlled string
                   |                            |value. [fedora-all]

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Florencio Cano  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-2021-44228 log4j:       |CVE-2021-44228 log4j:
                   |log4j-core:  Remote code    |log4j-core:  Remote code
                   |execution in Log4j 2 when   |execution in Log4j 2.x when
                   |logs contain an             |logs contain an
                   |attacker-controlled string  |attacker-controlled string
                   |value. [fedora-all]         |value. [fedora-all]

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value. [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|high                        |urgent

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Florencio Cano  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-2021-44228 log4j:       |CVE-2021-44228 log4j:
                   |log4j-core:  Remote code    |log4j-core: Remote code
                   |execution in Log4j 2.x when |execution in Log4j 2.x when
                   |logs contain an             |logs contain an
                   |attacker-controlled string  |attacker-controlled string
                   |value. [fedora-all]         |value [fedora-all]

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Jan  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Jan  ---
https://www.lunasec.io/docs/blog/log4j-zero-day/

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED

--- Comment #3 from Fedora Update System  ---
FEDORA-2021-f0f501d01f has been submitted as an update to Fedora 35.
https://bodhi.fedoraproject.org/updates/FEDORA-2021-f0f501d01f

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA

--- Comment #4 from Fedora Update System  ---
FEDORA-2021-f0f501d01f has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing
--advisory=FEDORA-2021-f0f501d01f`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2021-f0f501d01f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Adam Williamson  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #5 from Adam Williamson  ---
Don't we also need this for F34? It seems to be in the affected range of log4j
versions.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Clifford Perry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Clifford Perry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |)

--- Comment #7 from Clifford Perry  ---
@[e-mail] - Please prepare build + release for Fedora 34 as well.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Sergio Basto  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |)                           |

--- Comment #8 from Sergio Basto  ---
it is blocked by jansi

https://src.fedoraproject.org/rpms/jansi/pull-request/10

I'm ok with intervention of a proven packager .

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
   Fixed In Version|                            |log4j-2.15.0-1.fc35
         Resolution|---                         |ERRATA
        Last Closed|                            |2021-12-13 17:12:21

--- Comment #9 from Fedora Update System  ---
FEDORA-2021-f0f501d01f has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #10 from Adam Williamson  ---
mizdebsk has a valid point, there; we should not need to make unsafe changes to
jansi in order to address the bug in log4j. As he said, we either need to
figure out a way to build 2.15.0 with the older jansi, or backport just the CVE
fixes to log4j 2.13.3. Do you need help with this, Sergio? If so, it can be
arranged...

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Adam Williamson  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|ERRATA                      |---
            Version|35                          |34
             Status|CLOSED                      |ASSIGNED
           Keywords|                            |Reopened

--- Comment #11 from Adam Williamson  ---
Re-opening for F34.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Matthew Miller  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #12 from Matthew Miller  ---
FWIW it looks like the CentOS Stream 9 package is also 2.13.3
https://gitlab.com/redhat/centos-stream/rpms/log4j/-/tree/c9s; presumably there
will be a backported patch for that landing soon which theoretically should
apply.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #13 from Matthew Miller  ---
Oh, no — CS9 package got retired before the release. So nope to that.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #14 from Mikolaj Izdebski  ---
There are no plans to patch log4j package in CentOS Stream 9.
It was removed in June on my request: https://issues.redhat.com/browse/CS-626

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #15 from Sergio Basto  ---
(In reply to Adam Williamson from comment #10)

TLDR, I'm going orphan the log4j, I took log4j to avoid Javapocalypse and
because it was one dependency of ant. 
Now just 2 packages depends on log4j .

jericho-html (maintained by: terjeros) jericho-html-3.3-21.fc35.src requires
log4j = 2.15.0-1.fc36

jglobus (maintained by: ellert)  jglobus-2.1.0-24.fc36.src requires
mvn(log4j:log4j) = 2.15.0,  jglobus-ssl-proxies-2.1.0-24.fc36.noarch requires
mvn(log4j:log4j) = 2.15.0

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #16 from Adam Williamson  ---
OK. I'm out right now. If nobody else has taken care of it when I get home I'll
try and sort something out then.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

--- Comment #17 from Adam Williamson  ---
Update: working on this now. I've backported the thing log4j needed to jansi
2.1.1 (I hope). With that we should be able to build log4j 2.16.0 with no
breaking changes to jansi. I've just submitted the buildroot override for the
jansi change, have a scratch build for log4j lined up, if that scratch build
works I'll do an official build then submit an update for both packages.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |MODIFIED

--- Comment #18 from Fedora Update System  ---
FEDORA-2021-66d6c484f3 has been submitted as an update to Fedora 34.
https://bodhi.fedoraproject.org/updates/FEDORA-2021-66d6c484f3

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA

--- Comment #19 from Fedora Update System  ---
FEDORA-2021-66d6c484f3 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing
--advisory=FEDORA-2021-66d6c484f3`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2021-66d6c484f3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.

[Bug 2030945] CVE-2021-44228 log4j: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2030945

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|log4j-2.15.0-1.fc35         |log4j-2.15.0-1.fc35
                   |                            |log4j-2.16.0-1.fc34
         Resolution|---                         |ERRATA
             Status|ON_QA                       |CLOSED
        Last Closed|2021-12-13 17:12:21         |2021-12-22 01:13:17

--- Comment #20 from Fedora Update System  ---
FEDORA-2021-66d6c484f3 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.