Use Pax Logging 2.0.13 #1354

wborn · 2021-12-19T16:35:14Z

Pax Logging 2.0.13 uses log4j2 2.17 which fixes CVE-2021-45105.

Also-by: Łukasz Dywicki [email protected]
Signed-off-by: Wouter Born [email protected]

Pax Logging 2.0.13 uses log4j2 2.17 which fixes CVE-2021-45105. Also-by: Łukasz Dywicki <[email protected]> Signed-off-by: Wouter Born <[email protected]>

kaikreuzer · 2021-12-19T16:55:55Z

@wborn This now results for me in these errors at startup:

        Caused by: java.io.IOException: Error resolving artifact org.ops4j.pax.logging:pax-logging-log4j2:jar:2.0.12: [Could not find artifact org.ops4j.pax.logging:pax-logging-log4j2:jar:2.0.12 in openhab (https://openhab.jfrog.io/openhab/libs-snapshot/)]
                at org.ops4j.pax.url.mvn.internal.AetherBasedResolver.configureIOException(AetherBasedResolver.java:803)
                at org.ops4j.pax.url.mvn.internal.AetherBasedResolver.resolve(AetherBasedResolver.java:774)
                at org.ops4j.pax.url.mvn.internal.AetherBasedResolver.resolve(AetherBasedResolver.java:657)
                at org.ops4j.pax.url.mvn.internal.AetherBasedResolver.resolve(AetherBasedResolver.java:598)
                at org.ops4j.pax.url.mvn.internal.AetherBasedResolver.resolve(AetherBasedResolver.java:565)
                at org.apache.karaf.features.internal.download.impl.MavenDownloadTask.download(MavenDownloadTask.java:52)
                at org.apache.karaf.features.internal.download.impl.AbstractRetryableDownloadTask.run(AbstractRetryableDownloadTask.java:60)
                ... 6 more

~~This sounds as if the bundle is not being packaged with the distro?~~
I'm not sure why the distro still tries to find that (old) bundle version)?

kaikreuzer · 2021-12-19T17:04:22Z

The file

runtime/system/org/apache/karaf/features/framework/4.3.4/framework-4.3.4-features.xml

still lists

30:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-api/2.0.12</bundle>
56:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-api/2.0.12</bundle>

so the bundleReplacements does not seem to work as expected. @splatch Any idea?

wborn · 2021-12-19T17:05:41Z

I don't see this exception and it uses the updated bundles:

openhab> bundle:list -t 0 -s |grep pax-logging
  5 │ Active   │   8 │ 2.0.13                  │ org.ops4j.pax.logging.pax-logging-api
  7 │ Active   │   8 │ 2.0.13                  │ org.ops4j.pax.logging.pax-logging-log4j2

kaikreuzer · 2021-12-19T17:06:51Z

I actually have quite some other hits:

runtime/bin/instance
83:    CLASSPATH="${CLASSPATH}:${KARAF_HOME}/system/org/ops4j/pax/logging/pax-logging-api/2.0.12/pax-logging-api-2.0.12.jar"

runtime/bin/instance.bat
157:set CLASSPATH=%CLASSPATH%;%KARAF_HOME%\system\org\ops4j\pax\logging\pax-logging-api\2.0.12\pax-logging-api-2.0.12.jar

runtime/bin/shell
82:    CLASSPATH="${CLASSPATH}:${KARAF_HOME}/system/org/ops4j/pax/logging/pax-logging-api/2.0.12/pax-logging-api-2.0.12.jar"

runtime/bin/shell.bat
141:set CLASSPATH=%CLASSPATH%;%KARAF_HOME%\system\org\ops4j\pax\logging\pax-logging-api\2.0.12\pax-logging-api-2.0.12.jar

runtime/system/org/apache/karaf/features/framework/4.3.4/framework-4.3.4-features.xml
30:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-api/2.0.12</bundle>
31:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-log4j2/2.0.12</bundle>
56:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-api/2.0.12</bundle>
57:        <bundle start-level="8">mvn:org.ops4j.pax.logging/pax-logging-logback/2.0.12</bundle>

Can you confirm that all these already reference 2.0.13 in your case, @wborn?

wborn · 2021-12-19T17:16:16Z

These still also reference 2.0.12 for me but I don't see any exceptions.

We could remove the exclude again so the JAR is still there for the scripts that really depend on it:

https://github.com/openhab/openhab-distro/blob/main/distributions/openhab/src/main/descriptors/archive.xml#L54-L56

kaikreuzer · 2021-12-19T17:18:09Z

I don't think the exceptions come from the script, but rather from the framework-4.3.4-features.xml file... And this would mean that even the runtime would then still use the old version, so we could equally revert the whole PR then.

wborn · 2021-12-19T17:20:49Z

I'm fine with reverting it, better safe than sorry. 😉

J-N-K · 2021-12-19T17:23:27Z

Isn't the featureProcessing just about replacing the dependency in the XML with the new version? And wouldn't it be possible to update the version in the scripts as well?

wborn · 2021-12-19T17:32:28Z

Perhaps it works better when this line is uncommented:

openhab-distro/distributions/openhab/src/main/filtered-resources/userdata/etc/org.apache.karaf.features.cfg

Line 99 in cd3302f

#featureProcessing=org.apache.karaf.features.xml

kaikreuzer · 2021-12-19T17:41:25Z

Changing this manually on my install does not make a difference.
When is the processing supposed to happen? I thought that's done at build time already, while this setting is rather a runtime setting, isn't it?

kaikreuzer · 2021-12-19T17:53:43Z

A fresh install indeed works as expected.
The difference is the file userdata/etc/org.apache.karaf.features.xml, which is not overwritten by a distro update.
My "old" version is:

    <blacklistedRepositories>
        <repository>mvn:org.apache.karaf.features/framework/4.3.0-SNAPSHOT/xml/features</repository>
        <repository>mvn:org.apache.karaf.features/standard/4.3.0-SNAPSHOT/xml/features</repository>
        <repository>mvn:org.apache.karaf.features/enterprise/4.3.0-SNAPSHOT/xml/features</repository>
        <repository>mvn:org.apache.karaf.features/enterprise-legacy/4.3.0-SNAPSHOT/xml/features</repository>
        <repository>mvn:org.apache.karaf.features/spring/4.3.0-SNAPSHOT/xml/features</repository>
        <repository>mvn:org.apache.karaf.features/spring-legacy/4.3.0-SNAPSHOT/xml/features</repository>
    </blacklistedRepositories>

while the new one now contains instead:

    <bundleReplacements>
        <bundle originalUri="mvn:org.ops4j.pax.logging/pax-logging-api/[0,2.0.13)" replacement="mvn:org.ops4j.pax.logging/pax-logging-api/2.0.13" mode="maven" />
        <bundle originalUri="mvn:org.ops4j.pax.logging/pax-logging-log4j2/[0,2.0.13)" replacement="mvn:org.ops4j.pax.logging/pax-logging-log4j2/2.0.13" mode="maven" />
        <bundle originalUri="mvn:org.ops4j.pax.logging/pax-logging-logback/[0,2.0.13)" replacement="mvn:org.ops4j.pax.logging/pax-logging-logback/2.0.13" mode="maven" />
    </bundleReplacements>

wborn · 2021-12-19T17:56:39Z

Yes that's also what it looks like for me all the time. I did a clean install. 😉

We could add it to https://github.com/openhab/openhab-distro/blob/main/distributions/openhab/src/main/resources/bin/userdata_sysfiles.lst so it is overwritten and add also add the scripts that have it in their classpath to the repo.

kaikreuzer · 2021-12-19T18:02:27Z

Yeah, I thought the same: #1355

wborn · 2021-12-19T18:03:24Z

But it could also be that I don't run into these download issues because I run it on my desktop and it contains pax-logging 2.0.12 in the local Maven repo 😐

kaikreuzer · 2021-12-19T18:10:44Z

Wrt instance and shell scripts: They are created by the Karaf packaging itself, so we cannot easily fix them. But I am not sure if they work with openHAB at all as we do not use these (but only the karaf script). Shall we just ignore them?

wborn · 2021-12-19T18:24:54Z

Shall we just ignore them?

If we don't use them I also think they can be ignored. The runtime starts without issues and the client script also works fine.

It still seems to work fine if I remove the pax-logging artifacts from my local Maven repo.

splatch · 2021-12-19T18:30:51Z

Sorry gents, missed your concerns.

I don't think the exceptions come from the script, but rather from the framework-4.3.4-features.xml file... And this would mean that even the runtime would then still use the old version, so we could equally revert the whole PR then.

@kaikreuzer feature processing can work at runtime but then you need properly configured maven repos to pull replacement bundle.

I actually have quite some other hits:

These scripts are not usable with OH cause of directory layout anyways, so you can ignore them.

kaikreuzer · 2021-12-19T18:34:40Z

Latest distro build looks fine now, even for an update!

openhab-bot · 2021-12-20T13:57:17Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/openhab-3-2-release-discussion/130327/8

openhab-bot · 2021-12-20T13:59:59Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/openhab-3-2-release-discussion/130327/9

openhab-bot · 2021-12-21T02:52:55Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/issues-with-running-openhab-3-2-docker-image/130368/3

* Syncs distro customizations with Karaf 4.3.6 * Resolves app runbundles for the new dependencies * Undos the featuresProcessing for using Pax Logging 2.0.13 (openhab#1354) For release notes, see: https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12351123 Karaf 4.3.6 uses Pax Logging 2.0.14 (with Log4j 2.17.1) which fixes CVE-2021-44832. Signed-off-by: Wouter Born <[email protected]>

* Syncs distro customizations with Karaf 4.3.6 * Resolves app runbundles for the new dependencies * Undos the featuresProcessing for using Pax Logging 2.0.13 (#1354) For release notes, see: https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12351123 Karaf 4.3.6 uses Pax Logging 2.0.14 (with Log4j 2.17.1) which fixes CVE-2021-44832. Signed-off-by: Wouter Born <[email protected]>

openhab-bot · 2022-10-08T02:15:04Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/failing-dsc-binding-installation/139749/3

Use Pax Logging 2.0.13

4b59d52

Pax Logging 2.0.13 uses log4j2 2.17 which fixes CVE-2021-45105. Also-by: Łukasz Dywicki <[email protected]> Signed-off-by: Wouter Born <[email protected]>

wborn requested a review from a team as a code owner December 19, 2021 16:35

wborn mentioned this pull request Dec 19, 2021

Upgrade to Karaf 4.3.4 #1344

Merged

kaikreuzer merged commit cd3302f into openhab:main Dec 19, 2021

kaikreuzer added this to the 3.2 milestone Dec 19, 2021

wborn deleted the pax-logging-2.0.13 branch December 19, 2021 16:39

wborn added the security label Dec 19, 2021

kaikreuzer mentioned this pull request Dec 19, 2021

Make sure Karaf feature xml is overwritten on update #1355

Merged

This was referenced Dec 19, 2021

Override pax logging version to address #1349. #1350

Closed

Properly nail log4j security leak #1349

Closed

wborn mentioned this pull request Jan 15, 2022

Upgrade to Karaf 4.3.6 #1363

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use Pax Logging 2.0.13 #1354

Use Pax Logging 2.0.13 #1354

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021 •

edited

Loading

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

J-N-K commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021 •

edited

Loading

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021 •

edited

Loading

splatch commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

openhab-bot commented Dec 20, 2021

openhab-bot commented Dec 20, 2021

openhab-bot commented Dec 21, 2021

openhab-bot commented Oct 8, 2022

Use Pax Logging 2.0.13 #1354

Use Pax Logging 2.0.13 #1354

Conversation

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021 • edited Loading

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

J-N-K commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021 • edited Loading

kaikreuzer commented Dec 19, 2021

wborn commented Dec 19, 2021 • edited Loading

splatch commented Dec 19, 2021

kaikreuzer commented Dec 19, 2021

openhab-bot commented Dec 20, 2021

openhab-bot commented Dec 20, 2021

openhab-bot commented Dec 21, 2021

openhab-bot commented Oct 8, 2022

kaikreuzer commented Dec 19, 2021 •

edited

Loading

wborn commented Dec 19, 2021 •

edited

Loading

wborn commented Dec 19, 2021 •

edited

Loading