Upgrade ops4j pax-logging-* libraries to 2.0.11 #212
Comments
|
This has been mitigated by openhab/openhab-distro#1343 and will be finally addressed by openhab/openhab-distro#1344. |
|
How can I do that for openHAB 2? I tried it as you can see in the following: To make it undo I had also to reinstall openHAB 2. |
|
You'll need to find what uses of log4j there are in OpenHAB 2. Something like this: dpkg -L openhab2 |
grep -P '\.jar$' |
while read -r jar
do
contents="$(jar tf $jar | fgrep log4j)"
if [[ -n "$contents" ]]
then
echo $contents |
while read -r line
do
echo $jar:$line
done
fi
doneThis should tell you which I suspect pax logging 2.x is not backward compatible with 1.11.x so if you want to try this, you will need to do it with version 1.11.10 rather than 2.0.11. The former version also has the upgraded log4j 2 dependencies. That said, you may be better off applying the mitigation described in the forum post by editing |
|
Thank you. I have done the mitigation. Also using the 1.11.10 worked for me: |
It can be mitigated now by openhab/openhab-distro#1350. No need to wait for Karaf as there is mechanism to force specific version of pax logging. More over this way does work also for older/legacy Karaf releases which will be slower in providing security patches. |
Issue information:
Please see GHSA-xxfh-x98p-j8fr and GHSA-jfh8-c2jp-5v3q.
OpenHAB depends upon ops4j pax-logging-{api,log4j2,logback} 2.0.9. There is a critical remote code execution vulnerability rated at severity 10/10 involving log4j < 2.15.0, which pax-logging-log4j2 includes as an uberjar. This is deployed, at minimum, as part of the OpenHAB apt distribution, and very likely in other forms.
Version 2.0.11 of ops4j pax.logging composes version 2.15.0 of log4j classes rather than earlier versions.
Workaround
For those who, like me, use the OpenHAB apt repository, it is possible to work around this by using
dpkg-divertto rename away the 2.0.9 pax-logging jars included in theopenhabdeb package, and copy the 2.0.11 jars in their place:The 2.0.11 jars can be found in Maven Central:
The text was updated successfully, but these errors were encountered: