Log4j vulnerability in OCI HDFS Connector

[y-chandra]

Log4j vulnerability in OCI HDFS Connector

[mricken]

To be a little bit more verbose: In your pom.xml file, you can add direct dependencies on log4j version 2.17.0 or newer.

  <dependencies>
    <!-- ... -->
    <dependency>
        <groupId>com.oracle.oci.sdk</groupId>
        <artifactId>oci-hdfs-connector</artifactId>
        <version>3.3.1.0.0.0</version>
    </dependency>
    <!-- Add these with version 2.17.0 or newer -->
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j</artifactId>
      <version>2.17.0</version>
    </dependency>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-core</artifactId>
      <version>2.17.0</version>
    </dependency>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-slf4j-impl</artifactId>
      <version>2.17.0</version>
    </dependency>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-1.2-api</artifactId>
      <version>2.17.0</version>
    </dependency>
    <!-- ... -->
  </dependencies>

(Comment updated to reflect that CVE-2021-45046 requires upgrading to 2.17.0 or newer.)

[mricken]

It looks like the fix in 2.15.0 was incomplete, and that everyone should upgrade to 2.16.0.

See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

[y-chandra]

We've updated the version of log4j dependencies to 2.16.0 in our latest release of the OCI HDFS Connector (version 3.3.1.0.2.0). The latest version is available via github source/releases and maven to download and use.

[y-chandra]

Another vulnerability was discovered in version 2.16.0 of log4j that allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This vulnerability has been published as CVE-2021-45105. We're working on releasing a new version of the OCI HDFS Connector with log4j version 2.17.0 that has the fix for the aforementioned vulnerability.

[y-chandra]

We've updated the version of log4j dependencies to 2.17.0 in our latest release of the OCI HDFS Connector (version 3.3.1.0.3.0). The latest version is available via github source/releases and maven to download and use.

[jodoglevy]

This issue is now resolved -- however, we will leave this GitHub issue open for awareness purposes.