From 6208cbbded554fa04051773b4db4f3bb69805423 Mon Sep 17 00:00:00 2001 From: Ceki Gulcu Date: Fri, 24 Dec 2021 11:37:18 +0100 Subject: [PATCH] site updates Signed-off-by: Ceki Gulcu --- slf4j-site/src/site/pages/index.html | 6 +- slf4j-site/src/site/pages/log4shell.html | 172 +++++++++++++++--- slf4j-site/src/site/pages/scpSLF4J | 0 slf4j-site/src/site/pages/templates/header.js | 25 ++- .../resources/images/GitHub-Mark-32px.png | Bin 0 -> 1714 bytes .../resources/images/TwitterLogo_blue.svg | 16 ++ 6 files changed, 181 insertions(+), 38 deletions(-) create mode 100644 slf4j-site/src/site/pages/scpSLF4J create mode 100644 slf4j-site/src/site/resources/images/GitHub-Mark-32px.png create mode 100644 slf4j-site/src/site/resources/images/TwitterLogo_blue.svg diff --git a/slf4j-site/src/site/pages/index.html b/slf4j-site/src/site/pages/index.html index a6456d6b..6bceaa32 100755 --- a/slf4j-site/src/site/pages/index.html +++ b/slf4j-site/src/site/pages/index.html @@ -25,7 +25,7 @@
-

Simple Logging Facade for Java (SLF4J)

+

Simple Logging Facade for Java (SLF4J)

The Simple Logging Facade for Java (SLF4J) serves as a simple facade or abstraction for various logging frameworks @@ -39,8 +39,8 @@

Note that SLF4J-enabling your library implies the addition of only a single mandatory dependency, namely slf4j-api.jar. - If no binding is found on the class path, then SLF4J will default to - a no-operation implementation. + If no binding/provider is found on the class path, then SLF4J will + default to a no-operation implementation.

In case you wish to migrate your Java source files to SLF4J, diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index fdd9d63f..c14c35dc 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -28,22 +28,23 @@

-

Comments on the CVE-2021-44228 vulnerability

+

Comments on the log4shell(CVE-2021-44228) vulnerability

Preamble

-

The JNDI/LDAP/RMI/X serialization rabbit hole runs deep and - leads to much uncertainty. Thus, the contents of this page - are the result of our current knowledge and are provided AS IS - without warranty of any kind.

- +

The contents of this page are the result of our + understanding of the situation and are provided AS IS without + warranty of any kind.

+ +

What is CVE-2021-44228?

-

CVE-2021-44228 is a vulnerability classified under the - highest severity mark, i.e. 10 out of 10. It allows an attacker - to execute arbitrary code by injecting attacker-controlled data - into a logged message. As far as vulnerabilities are concerned, - CVE-2021-44228 is probably as bad as it gets. +

CVE-2021-44228 + is a vulnerability classified under the highest severity mark, + i.e. 10 out of 10. It allows an attacker to execute arbitrary + code by injecting attacker-controlled data into a logged + message. As far as vulnerabilities are concerned, CVE-2021-44228 + is probably as bad as it gets.

Superlatives aside, it is important to understand the -

Log4j 2.x is open for this attack because it performs a - lookup, aka string substitution, using the JNDI protocol, - whenever the "${jndi:...}" string is found - within a message parameter. As mentioned above, the contents of - the message parameter can be injected quite easily by the - attacker.

+

Log4j version 2.15 and earlier are open for this attack + because it performs a lookup, aka string substitution, using the + JNDI protocol, whenever the "${jndi:...}" + string is found within a message parameter. As mentioned above, + the contents of the message parameter can be injected quite + easily by the attacker.

Is log4j 1.x vulnerable?

@@ -143,11 +144,12 @@ with respect to CVE-2021-44228.

However, logback may make JNDI calls from within its - configuration file. This was recently - reported as a vulnerability of lesser severity. In response, we have released - logback version 1.2.8. Please upgrade. + configuration file. This was recently reported + in CVE-2021-42550 + (aka LOGBACK-1591) + as a vulnerability of lesser + severity. In response, we have released logback version + 1.2.9. Please upgrade.

Note that the vulnerability affecting logback requires write @@ -159,18 +161,23 @@

  1. attacker has write access to logback.xml
    2. -
  2. use of logback version older than 1.2.8
    3. +
  3. use of logback version older than 1.2.9
  4. loading of poisoned configuration data, which implies application restart or scan="true" set prior to attack

As a belt-and-suspenders type of precaution, in addition to - upgrading to logback version 1.2.8, we also recommend users to + upgrading to logback version 1.2.9, we also recommend users to deploy their logback configuration files as read-only.

-

If you have read thus far, you - probably understand that log4Shell/CVE-2021-44228 and - LOGBACK-1591 are of different severity levels.

+

More details about the contents latest logback releases can + be found in the logback + news page. + +

If you have read thus far, you probably + understand that log4Shell/CVE-2021-44228 and + LOGBACK-1591/CVE-2021-42550 are of different severity + levels.

Additional protective measure: write protect log4j{1,2}/logback configuration @@ -211,10 +218,116 @@ owner. If possible, they should also be monitored against changes and unauthorized manipulation.

- +

Prevalence of logging + frameworks

+ +

As discussed above, while log4j 2.14 and earlier are + vulnerable to log4shell, log4j 1.x and logback are not.

+ +

At this stage, it might be useful mention the prevalence of + each logging library in order to put things into + perspective. Here are the relevant figures as found + in mvnrepository site + on 2021-12-17.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProjectCategorygroup:artifactusageCountpercentage
SLF4JAPIorg.slf4j:slf4j-api52,24769%
Commons-loggingAPIcommons-logging:commons-logging10,41214%
SLF4JAPIorg.slf4j:jcl-over-slf4j7,54610%
LOG4J2APIorg.apache.logging.log4j:log4j-api5,226 7%
TotalAPI -45,174 100%
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProjectCategorygroup:artifactusageCountpercentage
LOGBACKimplementationch.qos.logback:logback-classic21,77048%
LOG4J1implementationlog4j:log4j16,61037%
LOG4J2implementationorg.apache.logging.log4j:log4j-core6,97415%
Totalimplementaion -45,174 100%
+ +

Notwithstanding its 48% prevalence overall (implementation), + no attacks have been reported against logback that we are aware + of.

+

Further reading

    +
  1. Log4j 2 - The Ghost in the logging framework from (2019)
  2. Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging @@ -222,7 +335,8 @@
  3. lunasec-io/lunasec
    4. - + +
  4. Security in context: When is a CVE not a CVE?
diff --git a/slf4j-site/src/site/pages/scpSLF4J b/slf4j-site/src/site/pages/scpSLF4J new file mode 100644 index 00000000..e69de29b diff --git a/slf4j-site/src/site/pages/templates/header.js b/slf4j-site/src/site/pages/templates/header.js index 35f75bc9..d992e746 100644 --- a/slf4j-site/src/site/pages/templates/header.js +++ b/slf4j-site/src/site/pages/templates/header.js @@ -1,12 +1,25 @@ +document.write(''); diff --git a/slf4j-site/src/site/resources/images/GitHub-Mark-32px.png b/slf4j-site/src/site/resources/images/GitHub-Mark-32px.png new file mode 100644 index 0000000000000000000000000000000000000000..8b25551a97921681334176ee143b41510a117d86 GIT binary patch literal 1714 zcmaJ?X;2eq7*4oFu!ne{XxAht2qc?8LXr|_LPCfTpaBK7K$c{I0Ld=NLIOeuC;@2) zZ$K%a)k+m-s0>xHmKxL%0V&0TRzzznhgyqrIC$F)0{WwLXLrBvd*^wc_uSc%h%m9E z{W5z3f#4_!7RvAyFh6!S_*<8qJ%KOIm?#E|L=rJQq=gB5C6WLG5;c?r%V0>EmEH#X z5eSwPRa6WXBMs#$5H%GtW2go-in9p>zW@UYDNNWc^XOXZQ? z1QjEV00I#$3^1wQUJ8&-2UsjB-G|9y(LDhMNN3PM{APL4eYi{(m*ERcUnJa{R+-3^ z34^A6;U^v`8N*O6ji%S@sd{fJqD`XFIUJ5zgTe5^5nj414F(y!G&=H(f)Lgzv?>%+ zAsWD}2qhpH7>|TU`X&W6IxDNuO_vET7|j5oG&&VDr!)hUO8+0KR?nh!m<)a!?|%yG zqOwq!CWCcIhE{<$E|F|@g>nP6FoYr6C<8>D?ID9%&5J(4oSbR1I^byW*g@__U z4QsF&uJSEcFeleM3~ChjEQGbHOjsGDMbyAl(p=Ttv9RaVo8~I#js@@Y9C^_2U})yn zzSHU%6FxuY?d;&65MyR({^lU*3$z$ZllDb(o&<7d;A_`h2U+3~BJ2Hv`{W}KEU801#cv_B|9Cm!ynR{S`AMsSn z;7E=B;mb!wx$L;S>yGXG^6=&WlQn9$s?&L%Y1D8TI^MlKB1DqsEng$>f4=xYWBoPI z_S1p!sJ#d2?YI4kPA{k}Eby?F=f-J9zIc`YDl^pzjVm~9ebE?Hn?t0Nx+la|D0MB; z9)2xv1G>a1|A9kQ>~DV<=X3-4yC&n!m8-3K#P z{X@0zRuQsy$+N ziSCoLJU{Z$nQy4A4Y5UJ07$5FA~qL2%Q+cLaqDU?Lz3?=BC5;Nk6BbTmmceEaM>-Z zi>O&-dSE=%ex;vcvCOk{*JQ5^_4M z4lW7%l9IqY(z7pV(?I@@8=KPFO82)O{VDI18-*d-k$YmI^XiuPs_LuFw<^ZcD}yP5 c*NrbeloN*74g`U%%F6r~k%+>C^#XapzmV0H-2eap literal 0 HcmV?d00001 diff --git a/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg b/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg new file mode 100644 index 00000000..b25ac935 --- /dev/null +++ b/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg @@ -0,0 +1,16 @@ + + +