search

newrelic / newrelic-java-agent

The New Relic Java agent
Apache License 2.0
202 stars 143 forks source link

Upgrade log4j-core version bump to fix CVE-2021-44228 #603

Closed ryan-lane closed 2 years ago

ryan-lane commented 2 years ago

Overview

log4j-core version bump to fix CVE-2021-44228

CLAassistant commented 2 years ago

CLA assistant check
All committers have signed the CLA.

Stephan202 commented 2 years ago

The latest Log4J2 tag right now is log4j-2.15.0-rc2, so it's not 100% clear what the contents of the 2.15.0 release on Maven Central are (somebody asked about it here: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990711764), but given the severity of the issue it'd be good to see a release with this change.

(It's not clear that the New Relic Agent can serve as an attack vector, but upgrading the dependency is easier than proving that no action is necessary.)

I updated the Picnic fork of New Relic Agent 7.4.0 to include this change (JAR, diff).

tbradellis commented 2 years ago

Thanks for the PR @ryan-lane !

(It's not clear that the New Relic Agent can serve as an attack vector, but upgrading the dependency is easier than proving that no action is necessary.)

@Stephan202 We ended up in a code freeze that will push our mid December release into Jan. I'll get this in front of the team to see what we need to do to break the freeze and about getting a point release out.

Stephan202 commented 2 years ago

@tbradellis tnx!

As for my earlier remark: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990753698 confirms that log4j-2.15.0-rc2 indeed matches the code published to Maven Central as 2.15.0.

(All of apache/logging-log4j2#608 is worth a read, I think.)

tbradellis commented 2 years ago

quick update. We will be doing a point release, along with some other effort (the exact of which is undetermined at the moment) to help customers address older NR java agent builds.

aSapien commented 2 years ago

Is it being backported to java agent 5.x?

Ref: https://github.com/newrelic/newrelic-java-agent/issues/605#issuecomment-991857942

kford-newrelic commented 2 years ago

@aSapien no, we will not be backporting to either the 4.x or 5.x code base. Per our security bulletin, if you cannot upgrade your agent to either 6.5.2 or 7.4.3, we recommend that you turn agent logging OFF until you can upgrade.