Properly nail log4j security leak

[splatch]

Current fix for log4j CVE provided via #1346 is not complete and definitive since there is still an area which allows to exploit vulnerability.

[jcz1]

FYI, Severity of CVE-2021-45046 is now Critical even with log4j 2.15 and LOG4J_FORMAT_MSG_NO_LOOKUPS

https://logging.apache.org/log4j/2.x/security.html

[kaikreuzer]

Where does it say critical? I only see "moderate severity" and only for use cases that do not apply to us.
On https://nvd.nist.gov/vuln/detail/CVE-2021-45046, it even says low with a base score of 3.7.

[jcz1]

F5 maybe? :-)

"Severity is now Critical

CVE-2021-45046 | Remote Code Execution
Severity | Critical
Base CVSS Score | 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Versions Affected | All versions from 2.0-beta9 to 2.15.0, excluding 2.12.2"

"The original severity of this CVE was rated as Moderate; since this CVE was published security experts found additional exploits against the Log4j 2.15.0 release, that could lead to information leaks, RCE (remote code execution) and LCE (local code execution) attacks.

Base CVSS Score changed from 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) to 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

The title of this CVE was changed from mentioning Denial of Service attacks to mentioning Remote Code Execution attacks."

"Other insufficient mitigation measures are: setting system property log4j2.formatMsgNoLookups or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true for releases >= 2.10, or modifying the logging configuration to disable message lookups with %m{nolookups}, %msg{nolookups} or %message{nolookups} for releases >= 2.7 and <= 2.14.1."

[kaikreuzer]

Ok, thanks. F5 does not help - seems I am on a CDN that still serves the previous version...

[splatch]

Solved through #1354 and #1355,