1
vast0906 2021-12-10 16:09:13 +08:00
官方的 release 包似乎正在发布
|
2
plasmetoz OP @vast0906 #1 是,但是现在打算先紧急维护一下,以为方法 4 用了以后把 java 服务全重启一下就行了,结果好像不行
|
3
zhady009 2021-12-10 16:18:32 +08:00 1
可以试试改 pattern 把%m 或者%msg 改成%m{nolookup}
|
4
cheng6563 2021-12-10 16:24:24 +08:00 2
用这个吧 JAVA_TOOL_OPTIONS=-Dlog4j2.formatMsgNoLookups=true
|
6
wbd31 2021-12-10 16:54:00 +08:00 1
formatMsgNoLookups 这个参数是 2.10 版本才加上的,对于之前同样受漏洞影响的版本无效
|
8
huage 2021-12-11 21:42:20 +08:00
Remediation Advice:
This issue was remediated in Log4J v2.15.0. The Apache Logging Services team provides the following mitigation advice: In previous releases (>=2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 protects against RCE by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false". You can manually check for use of affected versions of Log4J by searching your project repository for Log4J use, which is often in a pom.xml file. Where possible, upgrade to Log4J version 2.15.0. If you are using Log4J v1 there is a migration guide available. Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.15.0 where possible. If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components. |
9
troywinter 2021-12-11 23:27:42 +08:00
JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not affected by the LDAP attack vector. In these versions com.sun.jndi.ldap.object.trustURLCodebase is set to false meaning JNDI cannot load a remote codebase using LDAP.
|
10
44670 2021-12-12 03:00:50 +08:00
LOG4J_FORMAT_MSG_NO_LOOKUPS=true 似乎也可以
https://logging.apache.org/log4j/2.x/security.html 感觉 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 是国内的以讹传讹。 |
11
Kaiv2 2021-12-12 08:48:22 +08:00
|