log4j vulnerability (CVE-2021-44228) - not vulnerable #1196

aminvakil · 2021-12-13T05:43:49Z

Official Statement

https://blog.sentry.io/2021/12/15/sentrys-response-to-log4j-vulnerability-cve-2021-44228

Update

The two Java-based components used in self-hosted Sentry are Kafka and Zookeeper. Both of those projects have concluded that they are not vulnerable, therefore our best understanding is that self-hosted Sentry is not vulnerable to log4shell and does not need to be patched.

Original

I have a self-hosted installation of Sentry 21.9.0 (sorry for not updating it).

I know that some components of Sentry are written in Java. Today I have read the news about a critical log4j vulnerability (https://www.lunasec.io/docs/blog/log4j-zero-day/, CVE-2021-44228). Are Sentry installations using scripts from this repository affected? If so, what's the proper way to apply a fix or workaround?

Originally posted by @patrakov in #1175 (comment)

aminvakil · 2021-12-13T05:45:15Z

@patrakov Sentry does not have any Java code in it. That said it uses Kafka and Zookeeper so it'd be better to look there. Self-hosted uses Confluent packages so you may check them and submit a PR to upgrade the packages if you see something.

Originally posted by @BYK in #1175 (comment)

aminvakil · 2021-12-13T05:45:25Z

Would also love confirmation on the vulernability as @patrakov mentioned, since it does look like some old log4j versions (1.x) were used when I searched a self-hosted server for log4j with sudo find / -iname '*log4j*.jar'. But I'm not very familiar with Docker/Kafka so wouldn't know where to check next. Thank you 😊

Originally posted by @bryceadams in #1175 (comment)

acherifi · 2021-12-13T09:39:31Z

It seems that log4j 1.x is impacted only if some features are enabled check here.
On the latest Self Hosted Sentry kafka container

root@cf46a1c8a75e:/# find / -name 'log4j*'
/usr/share/java/kafka/log4j-1.2.17.jar
/etc/kafka/log4j.properties
/etc/confluent/docker/log4j.properties.template

The Kafka configuration does not seem to have the impacted configuration options enabled (you can check them here

jerbob92 · 2021-12-13T09:44:14Z

If people want to be sure, I have added the following to our docker-compose.yml:

...
services:
...
  zookeeper:
...
    environment:
....
      KAFKA_OPTS: "-Dzookeeper.4lw.commands.whitelist=ruok -Dlog4j2.formatMsgNoLookups=true"
  kafka:
...
    environment:
      KAFKA_LOG4J_OPTS: "-Dlog4j2.formatMsgNoLookups=true"

chadwhitacre · 2021-12-13T17:09:15Z

Hey, big thanks to everyone for jumping on this so quickly to report (@patrakov, @DerFlash), triage (@BYK, @bryceadams, @acherifi), mitigate (@jerbob92), and coordinate (@aminvakil). 🙏

hrishikeshdkakkad · 2021-12-14T03:57:33Z

So it is still not clear to me if sentry needs a patch update for the log4j vulnerability?

chadwhitacre · 2021-12-14T05:03:11Z

@hrishikeshdkakkad You probably don't need a patch, no.

What does everyone think? Should we add @jerbob92's configs to the default docker-compose.yml out of an abundance of caution? We have a release scheduled for the day after tomorrow ...

ChojinDSL · 2021-12-14T06:33:06Z

I've used the opensource trivy tool to scan each of the images listed in the docker-compose for the latest release of sentry.
confluentinc/cp-kafka:5.5.0
confluentinc/cp-zookeeper:5.5.0

both seem to use log4j and seem to be affected by the log4shell exploit. Just as an FYI.

jerbob92 · 2021-12-14T06:42:30Z

I've used the opensource trivy tool to scan each of the images listed in the docker-compose for the latest release of sentry. confluentinc/cp-kafka:5.5.0 confluentinc/cp-zookeeper:5.5.0

both seem to use log4j and seem to be affected by the log4shell exploit. Just as an FYI.

@ChojinDSL Can you post the output? Log4j and log4j2 are different and the first one is not affected.

ChojinDSL · 2021-12-14T06:48:34Z

confluentinc/cp-kafka:5.5.0
confluentinc/cp-kafka:5.5.0
log4j:log4j CVE-2019-17571 https://avd.aquasec.com/nvd/cve-2019-17571

@jerbob92 You're right, my bad. Those two components are not affected by log4shell.

aminvakil · 2021-12-14T07:02:02Z

@hrishikeshdkakkad You probably don't need a patch, no.

What does everyone think? Should we add @jerbob92's configs to the default docker-compose.yml out of an abundance of caution? We have a release scheduled for the day after tomorrow ...

We should not add it to default docker-compose.yml unless we're sure kafka is affected IMO.

thibauds · 2021-12-14T10:58:02Z

Just to confirm that Kafka is currently not affected, here is the discussion on the Kafka issue tracker
https://issues.apache.org/jira/browse/KAFKA-13534
and the related email discussion
https://lists.apache.org/thread/lgbtvvmy68p0059yoyn9qxzosdmx4jdv

aminvakil · 2021-12-14T12:12:44Z

I cannot find anything about zookeeper affected by this vulnerability, but I can't find anything definite about zookeeper not affected by this CVE too :(

Anyone got something?

chadwhitacre · 2021-12-14T14:56:21Z

Found it: https://issues.apache.org/jira/browse/ZOOKEEPER-4423.

(via NCSC-NL/log4shell#104)

Also fwiw AWS says their Zookeeper is in the clear.

chadwhitacre · 2021-12-14T14:57:06Z

I think the conclusion here is that Sentry self-hosted is not vulnerable, based on the self-reporting of the Kafka and Zookeeper projects. Agreed?

aminvakil · 2021-12-14T14:58:38Z

I think the conclusion here is that Sentry self-hosted is not vulnerable, based on the self-reporting of the Kafka and Zookeeper projects. Agreed?

I'd suggest keeping this issue open still, and change the title to clarify sentry is not vulnerable for users coming in the next few days.

jerbob92 · 2021-12-14T15:00:03Z

I think the conclusion here is that Sentry self-hosted is not vulnerable, based on the self-reporting of the Kafka and Zookeeper projects. Agreed?

I agree, both use log4j v1.

chadwhitacre · 2021-12-14T15:04:53Z

I'd suggest keeping this issue open still, and change the title to clarify sentry is not vulnerable for users coming in the next few days.

Good idea. I updated the title and also added a statement in the description. Thanks again, everyone.

chadwhitacre · 2021-12-14T15:14:39Z

I also made a note on #1193 to add something to the changelog for 21.12.0 stating that we are not vulnerable. I'm checking internally with our security team on the final wording to use.

chadwhitacre · 2021-12-14T15:16:21Z

Heading afk now to prep for our incredibly (though unfortunately) well-timed event, "The Future of Open Source: Is It Sustainable?" 😁 😭

doskoi · 2021-12-15T08:19:37Z

Mark: I've scanned the cp-kafka:5.5.0 and cp-zookeeper:5.50 (and all docker images) last week
The vulnerabilities result for confluentinc images:

Critical PyYAML
Critical log4j
High libtasn1-6
High Jinja2
High netty-handler
High netty-codec
High jackson-databind
High pip
High jackson-databind
High requests
High snakeyaml

Maybe some of these vulnerabilities is not affect to Sentry, but is there an easy way to check which component is in using or not?

aminvakil · 2021-12-15T10:27:40Z

Mark: I've scanned the cp-kafka:5.5.0 and cp-zookeeper:5.50 (and all docker images) last week The vulnerabilities result for confluentinc images:

Can you check again, AFAIK there was some discussion about whether log4j 1.x is vulnerable or not and whether different configurations and implementations are affected or not since last week.

And could you share what did you check docker images with? Does it have some verbose flag which can show more information?

Maybe some of these vulnerabilities is not affect to Sentry, but is there an easy way to check which component is in using or not?

I'd say our best shot is what kafka and communities around it say themselves and they say it's not affected:

#1196 (comment)

doskoi · 2021-12-15T10:51:00Z

I've scanned all images from docker compose (version 21.11.0) by enterprise version of aquasec (your quoted comment is ref the public website of aquasec)

Which report like this:

But since it is on the intranet, so I can't share the URL.
Here is a summary of the CRITICAL and HIGH results:

getsentry/sentry:21.11.0
High: urllib3 Fixed Version 8.3.2
High: Pillow Fixed Version 1.26.5
High: Django Fixed Version 2.2.25
getsentry/relay:21.11.0
getsentry/snuba:21.11.0
Critical: openssl Fixed Version 1.1.1k-1+deb11u1
yandex/clickhouse-server:20.3.9.70
High: openssl Fixed Version 1.1.1-1ubuntu2.1~18.04.13
maxmindinc/geoipupdate:v4.7.1
Critical: apk-tools Fixed Version 2.12.6-r0
High: ssl_client Fixed Version 1.32.1-r7
High: busybox Fixed Version 1.32.1-r7
confluentinc/cp-kafka:5.5.0
High: libtasn1-6
Critical: PyYAML
Critical: log4j
High: Jinja2
High: netty-handler
High: netty-codec
High: jackson-databind
High: pip
High: jackson-databind
High: requests
High: snakeyaml
memcached:1.6.9-alpine
Critical: apk-tools Fixed Version 2.12.6-r0
High: ssl_client Fixed Version 1.33.1-r6
High: busybox Fixed Version 1.33.1-r6
nginx:1.21.0-alpine
Critical: apk-tools Fixed Version 2.12.6-r0
Critical: curl Fixed Version 7.79.0-r0
Critical: libcurl Fixed Version 7.79.0-r0
High: ssl_client Fixed Version 1.32.1-r7
High: busybox Fixed Version 1.32.1-r7
High: curl Fixed Version 7.77.0-r0
High: libcurl Fixed Version 7.77.0-r0
High: libgcrypt Fixed Version 1.8.8-r0
High: libxml2 Fixed Version 2.9.10-r7
postgres:9.6
redis:6.2.4-alpine
Critical: apk-tools Fixed Version 2.12.6-r0
High: redis Fixed Version 6.2.5
High: ssl_client Fixed Version 1.33.1-r6
High: busybox Fixed Version 1.33.1-r6
tianon/exim4:latest
getsentry/symbolicator:0.4.0
confluentinc/cp-zookeeper:5.5.0
High: libtasn1-6
Critical: PyYAML
Critical: log4j
High: Jinja2
High: netty-handler
High: netty-codec
High: jackson-databind
High: pip
High: jackson-databind
High: requests
High: snakeyaml

I will check it again after I make the patches for OS vulners.

aminvakil · 2021-12-15T11:07:37Z

https://lists.apache.org/thread/lgbtvvmy68p0059yoyn9qxzosdmx4jdv :

AFAICS sentry kafka does not have these conditions, but sure we can use some more investigation into this...

jerbob92 · 2021-12-15T11:10:28Z

https://lists.apache.org/thread/lgbtvvmy68p0059yoyn9qxzosdmx4jdv :

AFAICS sentry kafka does not have these conditions, but sure we can use some more investigation into this...

Yeah, you are right. Log4j can be made vulnerable with specific settings, but they are not default like with Log4j2.
The vulnerability that Aqua is listing is a different CVE and is from 2019.

doskoi · 2021-12-15T11:11:26Z

The CVE in thread is: https://avd.aquasec.com/nvd/cve-2021-44228/

chadwhitacre · 2021-12-15T22:52:16Z

We published our official statement today. Gonna go ahead and close this out. Good work, team. 👏 🙏

ankit360s · 2021-12-22T09:50:40Z

@chadwhitacre any update about CVE-2021-45105?

aminvakil · 2021-12-22T09:53:14Z

@Ankitva Other than sentry official statement which has already been mentioned and shared what else do you need clarification about?

Edit: Ah, this is the one which has been fixed in 2.17.0, sentry statement is prior to 2.17.0 release.

chadwhitacre · 2021-12-22T14:04:48Z

Apache Log4j2 versions 2.0-alpha1 through 2.16.0

@Ankitva Sentry is not vulnerable, the components we use use 1.x.

rvanlieshout · 2021-12-22T14:16:58Z

If it uses > 1.2.17

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

chadwhitacre · 2021-12-22T14:46:06Z

Thanks @rvanlieshout, reticketed as #1219.

getsantry bot added the Status: Untriaged label Dec 13, 2021

aminvakil mentioned this issue Dec 13, 2021

General Thread (Q4 2021) #1175

Closed

aminvakil mentioned this issue Dec 13, 2021

Does sentry use log4j? #1197

Closed

chadwhitacre removed the Status: Untriaged label Dec 13, 2021

chadwhitacre changed the title ~~log4j vulnerability (CVE-2021-44228)~~ log4j vulnerability (CVE-2021-44228) - not vulnerable Dec 14, 2021

chadwhitacre mentioned this issue Dec 14, 2021

Release 21.12.0 #1193

Closed

3 tasks

chadwhitacre added this to the React to log4shell milestone Dec 15, 2021

chadwhitacre mentioned this issue Dec 15, 2021

Self-hosted Sentry is not vulnerable to log4shell #1203

Merged

chadwhitacre closed this as completed Dec 15, 2021

chadwhitacre mentioned this issue Dec 22, 2021

Address vulnerability in log4j 1.2.17 (CVE-2019-17571) #1219

Closed

github-actions bot locked and limited conversation to collaborators Jan 7, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

log4j vulnerability (CVE-2021-44228) - not vulnerable #1196

log4j vulnerability (CVE-2021-44228) - not vulnerable #1196

aminvakil commented Dec 13, 2021 •

edited by chadwhitacre

Loading

aminvakil commented Dec 13, 2021

aminvakil commented Dec 13, 2021

acherifi commented Dec 13, 2021

jerbob92 commented Dec 13, 2021

chadwhitacre commented Dec 13, 2021

hrishikeshdkakkad commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

ChojinDSL commented Dec 14, 2021 •

edited

Loading

jerbob92 commented Dec 14, 2021 •

edited

Loading

ChojinDSL commented Dec 14, 2021

aminvakil commented Dec 14, 2021 •

edited

Loading

thibauds commented Dec 14, 2021

aminvakil commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

aminvakil commented Dec 14, 2021

jerbob92 commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

doskoi commented Dec 15, 2021 •

edited

Loading

aminvakil commented Dec 15, 2021

doskoi commented Dec 15, 2021 •

edited

Loading

aminvakil commented Dec 15, 2021

jerbob92 commented Dec 15, 2021

doskoi commented Dec 15, 2021

chadwhitacre commented Dec 15, 2021

ankit360s commented Dec 22, 2021 •

edited

Loading

aminvakil commented Dec 22, 2021 •

edited

Loading

chadwhitacre commented Dec 22, 2021

rvanlieshout commented Dec 22, 2021

chadwhitacre commented Dec 22, 2021

log4j vulnerability (CVE-2021-44228) - not vulnerable #1196

log4j vulnerability (CVE-2021-44228) - not vulnerable #1196

Comments

aminvakil commented Dec 13, 2021 • edited by chadwhitacre Loading

Official Statement

Update

Original

aminvakil commented Dec 13, 2021

aminvakil commented Dec 13, 2021

acherifi commented Dec 13, 2021

jerbob92 commented Dec 13, 2021

chadwhitacre commented Dec 13, 2021

hrishikeshdkakkad commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

ChojinDSL commented Dec 14, 2021 • edited Loading

jerbob92 commented Dec 14, 2021 • edited Loading

ChojinDSL commented Dec 14, 2021

aminvakil commented Dec 14, 2021 • edited Loading

thibauds commented Dec 14, 2021

aminvakil commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

aminvakil commented Dec 14, 2021

jerbob92 commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

chadwhitacre commented Dec 14, 2021

doskoi commented Dec 15, 2021 • edited Loading

aminvakil commented Dec 15, 2021

doskoi commented Dec 15, 2021 • edited Loading

aminvakil commented Dec 15, 2021

jerbob92 commented Dec 15, 2021

doskoi commented Dec 15, 2021

chadwhitacre commented Dec 15, 2021

ankit360s commented Dec 22, 2021 • edited Loading

aminvakil commented Dec 22, 2021 • edited Loading

chadwhitacre commented Dec 22, 2021

rvanlieshout commented Dec 22, 2021

chadwhitacre commented Dec 22, 2021

aminvakil commented Dec 13, 2021 •

edited by chadwhitacre

Loading

ChojinDSL commented Dec 14, 2021 •

edited

Loading

jerbob92 commented Dec 14, 2021 •

edited

Loading

aminvakil commented Dec 14, 2021 •

edited

Loading

doskoi commented Dec 15, 2021 •

edited

Loading

doskoi commented Dec 15, 2021 •

edited

Loading

ankit360s commented Dec 22, 2021 •

edited

Loading

aminvakil commented Dec 22, 2021 •

edited

Loading