Add a post on the state of the log4j CVE in the Scala ecosystem. #1315

sjrd · 2021-12-16T13:14:34Z

Also cc @romanowski , @tgodzik , @lrytz

Also if there are library maintainers who would like to share the status of their libraries, feel free to say so.

vincenzobaz

Extremely clear and precise. I would add a conclusion to reassure and call to action

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

sjrd · 2021-12-16T13:31:04Z

I would add a conclusion to reassure and call to action

Do you have an example/draft of what you have in mind?

lrytz · 2021-12-16T13:37:27Z

I saw this floating around on twitter today: https://github.com/stripe/log4j-remediation-tools

But neither tried it nor looked at it in any depth.

vincenzobaz · 2021-12-16T13:48:06Z

Do you have an example/draft of what you have in mind?

Something along the lines of:

Conclusion

The log4j vulnerabilities shook our community and reminded us how dependent we all are on open source software.
We are grateful to the maintainers and contributors of Scala open source libraries who reacted quickly to protect their users and to the people behind the tools that enabled such a quick response.

Please do not hesitate to update this post with libraries and tools vulnerable to the CVEs and to propose tools to help address them.

sjrd · 2021-12-16T13:55:26Z

Thanks. I added your suggestions.

romanowski · 2021-12-16T13:56:49Z

LGTM.

I only wonder if we can also include a small snippet with an sbt task (or piece of code to run in sbt console) to filter fullClasspath based on groupId, name and version attributed from Attributed matching affected log4j versions.

sjrd · 2021-12-16T13:59:12Z

I only wonder if we can also include a small snippet with an sbt task (or piece of code to run in sbt console) to filter fullClasspath based on groupId, name and version attributed from Attributed matching affected log4j versions.

My intuition would be to use grep for that. Do you have something smarter in mind?

eed3si9n · 2021-12-16T14:18:41Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+
+Two very widespread vulnerabilities in log4j v2 are wreaking havoc in the JVM ecosystem.
+The vulnerabilities are registered as [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) and [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).
+


Suggested change

The vulnerability allows unauthenticated remote code execution, and it is triggered when a specially crafted string provided by the attacker through a variety of different input vectors. For further technical guidance, see [Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) for example.

SethTisue

👍

SethTisue · 2021-12-16T14:46:29Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+
+## Useful sbt tasks and settings
+
+If your application is written in sbt, which is common in the Scala ecosystem, here are some information on how to identify the classpath of your application, and how to force an upgrade of the log4j dependencies.


s/written in sbt/built with sbt/

s/identify the classpath/determine the classpath/

SethTisue · 2021-12-16T14:47:17Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+[success] Total time: 0 s, completed Dec 16, 2021 11:07:28 AM
+```
+
+With older versions of sbt, the command looks like


How old, exactly? ("version x.y or earlier")

Suggested change

With older versions of sbt, the command looks like

Prior to sbt 1.1.0, the command looks like

eed3si9n · 2021-12-16T14:47:57Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+| Artifact or tool name | Fixed in version |
+|-----------------------|------------------|
+| sbt | 1.5.7 |


Suggested change

| Artifact or tool name | Fixed in version |

|-----------------------|------------------|

| sbt | 1.5.7 |

| Artifact or tool name | Affected versions | Fixed in version |

|----------------------|------------------|------------------|

| sbt | 1.x < 1.5.7 | 1.5.7 |

Log4j is not enabled by default since sbt 1.4.0, but all users are recommended to upgrade to the latest fixed version. Any organization using sbt as part of CI/CD (continuous integration and delivery), automated publishing, and projects that expose TCP/IP entry point during testing may be most vulnerable to an exploit.

eed3si9n · 2021-12-16T14:57:41Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+
+### `fullClasspath`
+
+The task `fullClasspath`, properly scoped to a project and a configuration, gives the final, full classpath with which your project is executed.


Should we recommend externalClasspath instead? For a large project, this would cut down some noise coming from internal (other subprojects) classpath.

I added a sentence to suggest externalClasspath in some cases for large builds. Let me know if it looks accurate to you.

eed3si9n

Thanks for writing this up!

sjrd · 2021-12-16T15:22:59Z

Updated with your suggestions.

sjrd · 2021-12-16T17:00:53Z

Thanks for the reviews. I'll merge it now, but further comments and updates are of course very welcome.

som-snytt · 2021-12-16T19:35:19Z

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md

+
+A project is affected by the log4j vulnerabilities if it contains a vulnerable version of a log4j artifact on its classpath.
+
+You may find below a non-comprenhensive list of core Scala tools and libraries known to be affected by the vulnerability, and in which version (if any) it is addressed.


non-comprehensive

sjrd requested review from SethTisue and eed3si9n December 16, 2021 13:14

sjrd force-pushed the blog-log4j branch 2 times, most recently from 34647b8 to 6dc442f Compare December 16, 2021 13:20

vincenzobaz approved these changes Dec 16, 2021

View reviewed changes

_posts/2021-12-16-state-of-log4j-in-scala-ecosystem.md Outdated Show resolved Hide resolved

sjrd force-pushed the blog-log4j branch from 6dc442f to 86e3632 Compare December 16, 2021 13:29

sjrd force-pushed the blog-log4j branch from 86e3632 to 9f50aae Compare December 16, 2021 13:55

eed3si9n reviewed Dec 16, 2021

View reviewed changes

SethTisue approved these changes Dec 16, 2021

View reviewed changes

eed3si9n reviewed Dec 16, 2021

View reviewed changes

eed3si9n approved these changes Dec 16, 2021

View reviewed changes

Add a post on the state of the log4j CVE in the Scala ecosystem.

d6766f3

sjrd force-pushed the blog-log4j branch from 9f50aae to d6766f3 Compare December 16, 2021 15:23

sjrd merged commit 3663e7d into scala:main Dec 16, 2021

sjrd deleted the blog-log4j branch December 16, 2021 17:01

som-snytt reviewed Dec 16, 2021

View reviewed changes


		Two very widespread vulnerabilities in log4j v2 are wreaking havoc in the JVM ecosystem.
		The vulnerabilities are registered as [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) and [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).


	The vulnerability allows unauthenticated remote code execution, and it is triggered when a specially crafted string provided by the attacker through a variety of different input vectors. For further technical guidance, see [Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) for example.


		## Useful sbt tasks and settings

		If your application is written in sbt, which is common in the Scala ecosystem, here are some information on how to identify the classpath of your application, and how to force an upgrade of the log4j dependencies.

	With older versions of sbt, the command looks like
	Prior to sbt 1.1.0, the command looks like

-| Artifact or tool name | Fixed in version |
-|-----------------------|------------------|
-| sbt | 1.5.7 |
+| Artifact or tool name | Affected versions | Fixed in version |
+|----------------------|------------------|------------------|
+| sbt | 1.x < 1.5.7 | 1.5.7 |
+Log4j is not enabled by default since sbt 1.4.0, but all users are recommended to upgrade to the latest fixed version. Any organization using sbt as part of CI/CD (continuous integration and delivery), automated publishing, and projects that expose TCP/IP entry point during testing may be most vulnerable to an exploit.


		### `fullClasspath`

		The task `fullClasspath`, properly scoped to a project and a configuration, gives the final, full classpath with which your project is executed.


		A project is affected by the log4j vulnerabilities if it contains a vulnerable version of a log4j artifact on its classpath.

		You may find below a non-comprenhensive list of core Scala tools and libraries known to be affected by the vulnerability, and in which version (if any) it is addressed.

Add a post on the state of the log4j CVE in the Scala ecosystem. #1315

Add a post on the state of the log4j CVE in the Scala ecosystem. #1315

Uh oh!

Conversation

sjrd commented Dec 16, 2021

Uh oh!

vincenzobaz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sjrd commented Dec 16, 2021

Uh oh!

lrytz commented Dec 16, 2021

Uh oh!

vincenzobaz commented Dec 16, 2021

Conclusion

Uh oh!

sjrd commented Dec 16, 2021

Uh oh!

romanowski commented Dec 16, 2021

Uh oh!

sjrd commented Dec 16, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SethTisue left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eed3si9n left a comment

Choose a reason for hiding this comment

Uh oh!

sjrd commented Dec 16, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sjrd commented Dec 16, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sjrd commented Dec 16, 2021 •

edited

Loading