Skip to main content
Common Reference

Log4j 1.x Security Vulnerabilties

Known Issue

Affecting versions up to and incuding 7.1.4.

Tungsten Versions up to 7.1.4 embed log4j v1 which contain a number of CVEs, including the following:

  • CVE-2019-17571
  • CVE-2020-9488
  • CVE-2020-9493
  • CVE-2022-23302
  • CVE-2022-23307
  • CVE-2022-23305

With the following conditions:

  • The affected application must be using the vulnerable SocketServer class from Log4j 1.2 and must be configured to listen for logging data over the network. Additionally, deserialization gadgets must be present in the application's classpath for successful exploitation.
  • The affected application must be specifically configured to use the JMSSink component, which is not the default configuration in Log4j 1.x. The vulnerability is only present when JMSSink is enabled and configured.
  • The affected application must be using the Chainsaw component that was included as part of Log4j 1.2.x.
  • The affected application must be configured to read serialized log events in Chainsaw. This is a specific configuration that enables the vulnerability.
  • The affected application must be specifically configured to use the JDBCAppender in Log4j 1.2.x. This is not the default configuration, so only applications that have explicitly enabled this component are vulnerable.

Since later versions of log4j are not backwards compatible with these releases of Tungsten, the solution is to obtain a copy of the reload4j v1.2.26 drop-in replacement which resolves these issues.

To update, follow the steps below. In the example we are using the 6.1.24 version of Tungsten Clustering, in your environment you will need to navigate to the appropriate directory for your release and product.

  • Obtain a copy of the replacement jar file from the above link, or using the curl example below.
  • Move the existing log4j-1.x.jar file located in /opt/continuent/software/tungsten-clustering-6.1.24-6/cluster-home/lib to a backup directory, ensuring it no longer remains in the software tree for Tungsten.
  • Copy the new reload4j.jar file to /opt/continuent/software/tungsten-clustering-6.1.24-6/cluster-home/lib
  • Then issue an update using the --replace-release option.

A full example of the steps are as follows:

shell> cd 
shell> curl "https://repo1.maven.org/maven2/ch/qos/reload4j/reload4j/1.2.26/reload4j-1.2.26.jar" > reload4j-1.2.26.jar
shell> cd /opt/continuent/software/tungsten-clustering-6.1.24/cluster-home/lib
shell> mv log4j-1.2.17-secure.jar /tmp
shell> mv ~/reload4j-1.2.26.jar /opt/continuent/software/tungsten-clustering-6.1.24/cluster-home/lib
shell> cd /opt/continuent/software/tungsten-clustering-6.1.24/

<<For Tungsten Clustering Users>>
shell> cctrl
cctrl> set policy maintenance
cctrl> exit
<<----------------------------->>

shell> tools/tpm update --replace-release

<<For Tungsten Clustering Users>>
shell> cctrl
cctrl> set policy automatic
cctrl> exit
<<----------------------------->>

If you are running Tungsten Clustering, you may opt to use the additional --no-connectors option to the tpm update command to allow you to restart the connectors when convenient.

note

These steps are only applicable to versions up to and includeing v7.1.4. v2 of log4j is included from v7.2.0 onwards