[
https://issues.apache.org/jira/browse/ZOOKEEPER-4431?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17477314#comment-17477314
]
Bradley Parker commented on ZOOKEEPER-4431:
-------------------------------------------
Hey [~cnauroth], with respect to
[CVE-2021-4104|https://nvd.nist.gov/vuln/detail/CVE-2021-4104] which does
affect 1.x, can you confirm my thoughts on the applicability to Zookeeper?
I don't think it applies to zookeeper as based on the NIST description it
depends on:
# The use of JMSAppender
# the attacker has write access to the Log4j configuration
Based on the properties file at
[https://github.com/apache/zookeeper/blob/master/conf/log4j.properties] it
doesn't look like Zookeper uses the JMSAppender, and I would assume based on
the [Zookeeper
docs|https://zookeeper.apache.org/doc/r3.1.2/zookeeperAdmin.html#sc_logging]
that the only people who should be modifying the properties are admins.
> Log4j vulnerabilities in Apache zookeeper
> -----------------------------------------
>
> Key: ZOOKEEPER-4431
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-4431
> Project: ZooKeeper
> Issue Type: Bug
> Affects Versions: 3.6.2
> Environment: Prod
> Reporter: lekshmi anandakrishnan
> Assignee: Chris Nauroth
> Priority: Critical
>
> Please confirm whether apache zookeeper 3.6.2 has any impact on the below
> log4j CVE`s. Apache zookeeper uses log4j 1.2.17 and since Log4J 1.X version
> is an end of life in Aug 2015 which is vulnerable already.
>
> |CVE ID|Title|
> |CVE-2021-4104 (1.X)|Apache Log4j 1.2 Remote Code Execution Vulnerability|
> |CVE-2021-45105 (2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability
> (Log4Shell)|
> |CVE-2021-45046 (2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability
> (CVE-2021-45046)|
> |CVE-2021-44228(2.X)|Apache Log4j Remote Code Execution (RCE) Vulnerability
> (Log4Shell)|
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
