Critical Vulnerability in Apache log4j 2 Library Affects Hazelcast Packages
Summary
GHSA-v57x-gxfj-484q: Security Advisory for "Log4Shell". Affects com.hazelcast.jet:hazelcast-jet versions >= 4.1, < 4.5.3. Fixed in 4.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache log4j 2 library is a popular logging utility used in various software applications, including the Hazelcast packages. It provides a flexible and efficient logging framework for developers. However, a highly critical 0-day exploit, known as "Log4Shell" (CVE-2021-44228), has been discovered in Apache log4j 2. This vulnerability affects versions from 2.0-beta9 to 2.14.1 (inclusive) and can allow a remote attacker to execute code on the server by exploiting an attacker-controlled string value with the attacker's JNDI LDAP server lookup. Hazelcast Management Center, Hazelcast IMDG, Hazelcast Jet, and Hazelcast Platform are among the affected packages.
Vulnerability Detail
The Log4Shell vulnerability (CVE-2021-44228) in Apache log4j 2 library poses a significant security risk. It enables a remote attacker to execute arbitrary code on the server if the system logs a string value controlled by the attacker, which triggers a JNDI LDAP server lookup. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has a CVSS score of 10.0, indicating its criticality.
How To Fix
Minimum fixed version
4.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, there are some workarounds to mitigate the Log4Shell vulnerability. One option is to disable lookups via the environment variable by setting LOG4J_FORMAT_MSG_NO_LOOKUPS=true. Another option is to disable lookups in the log4j2 configuration by adding -Dlog4j2.formatMsgNoLookups=true as a command line option or specifying %m{nolookups} in the PatternLayout configuration. Additionally, removing the JndiLookup class from the log4j-core jar can help mitigate the vulnerability, although it may affect certain functionalities.
Conclusion
The Log4Shell vulnerability in Apache log4j 2 library poses a critical security risk to Hazelcast packages. It is essential to upgrade to the latest patched versions of the affected packages and the log4j library to mitigate the vulnerability. If immediate upgrading is not possible, applying the recommended workarounds can help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast.jet:hazelcast-jet →
FAQ
The Log4Shell vulnerability (CVE-2021-44228) is a highly critical 0-day exploit found in Apache log4j 2 library. It allows a remote attacker to execute code on the server by exploiting an attacker-controlled string value with the attacker's JNDI LDAP server lookup.
The Log4Shell vulnerability affects Hazelcast Management Center, Hazelcast IMDG, Hazelcast Jet, and Hazelcast Platform packages.
The Log4Shell vulnerability can lead to unauthorized code execution on the server, potentially resulting in data breaches, unauthorized access, and compromise of the entire system.
To fix the Log4Shell vulnerability, it is crucial to upgrade to the latest patched version of the Apache log4j 2 library. Hazelcast has released updated versions of the affected packages that include the patched library.
Yes, there are workarounds available to mitigate the Log4Shell vulnerability. These include disabling lookups via environment variables or log4j2 configuration, and removing the JndiLookup class from the log4j-core jar.
