log4shell | Operational information regarding the log4shell | Security Testing library

by NCSC-NL Python Version: log4shell_info_20220615 License: No License

X-Ray Key Features Code Snippets(3)Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | log4shell Summary

log4shell is a Python library typically used in Testing, Security Testing applications. log4shell has no bugs, it has no vulnerabilities and it has medium support. However log4shell build file is not available. You can download it from GitHub.

This repo contains operational information regarding the Log4shell vulnerability in the Log4j logging library. Especially CVE-2021-44228 / CVE-2021-45046 and also covers CVE-2021-4104 / CVE-2021-45105. For additional information see:. For affected organisations and CISOs searching for concise mitigation guidance, the Log4Shell for OES - Full presentation slides for CISOs and techies describes the vulnerability and explains all steps necessary to successfully mitigate the vulnerability (patching is not enough).

Support

Quality

Security

License

Reuse

Support

log4shell has a medium active ecosystem.

It has 1891 star(s) with 637 fork(s). There are 69 watchers for this library.

It had no major release in the last 12 months.

There are 0 open issues and 98 have been closed. On average issues are closed in 6 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of log4shell is log4shell_info_20220615

Quality

log4shell has 0 bugs and 0 code smells.

Security

log4shell has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

log4shell code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

log4shell does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

log4shell releases are available to install and integrate.

log4shell has no build file. You will be need to create the build yourself to build the component from source.

It has 253 lines of code, 22 functions and 5 files.

It has low code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed log4shell and discovered the below as its top functions. This is intended to give you an instant insight into log4shell implemented functionality, and help decide if they suit your requirements.

Mutate table .
Parse a record .
Parse a PDF file .
Convert a log record to a human readable string .
Check if the entry is valid .
Parse software list .
Parse diff file .
Generate a CSV file .
check the status of the cve field
Sanitize a status field .

Get all kandi verified functions for this library.

log4shell Key Features

No Key Features are available at this moment for log4shell.

log4shell Examples and Code Snippets

Ox4Shell,Usage

Python

Lines of Code : 63

License : Permissive (MIT)

Copy

~/Ox4Shell » python ox4shell.py --help
usage: ox4shell [-h] [-d] [-m MOCK] [--max-depth MAX_DEPTH] [--decode-base64] (-p PAYLOAD | -f FILE)

   ____       _  _   _____ _          _ _ 
  / __ \     | || | / ____| |        | | |
 | |  | |_  _| || || (_

Content,Folder "scripts"

Java

Lines of Code : 24

License : Strong Copyleft (GPL-3.0)

Copy

$ bash identify-log4j-class-location.sh ../playground/
[+] Searching class 'org/apache/logging/log4j/core/lookup/JndiLookup.class' across '../playground/' folder...
[*] Inspecting file: BBlog4j - core - 2.14.1.jar

log4shelldetect,Usage

Lines of Code : 5

License : Permissive (Unlicense)

Copy

Usage: log4shelldetect [options] 

Options:
  -mode string
        the output mode, either "report" (every jar pretty printed) or "list" (list of potentially vulnerable files) (default "report")

Community Discussions

Trending Discussions on log4shell

Log4j vulnerability - Is Log4j 1.2.17 vulnerable (was unable to find any JNDI code in source)?

Syntax error with complicated postgresql sql query

hotfix securing many log4j jars against log4shell

Does the Log4j security violation vulnerability affect log4net?

How can I mitigate the Log4Shell vulnerability in version 1.2 of Log4j?

How to mitigate Apache Log4j Deserialization RCE (CVE-2019-17571)

Is formsflow.ai being affected by log4shell vulnerability?

How to find log4shell vulnerable classes in my assemblies (jar/ear/war)

CVE-2021-44228 + slf4j + common-logging

Is slf4j affected by log4shell?

QUESTION

Log4j vulnerability - Is Log4j 1.2.17 vulnerable (was unable to find any JNDI code in source)?

Asked 2022-Feb-01 at 15:47

With regard to the Log4j JNDI remote code execution vulnerability that has been identified CVE-2021-44228 - (also see references) - I wondered if Log4j-v1.2 is also impacted, but the closest I got from source code review is the JMS-Appender.

The question is, while the posts on the Internet indicate that Log4j 1.2 is also vulnerable, I am not able to find the relevant source code for it.

Am I missing something that others have identified?

Log4j 1.2 appears to have a vulnerability in the socket-server class, but my understanding is that it needs to be enabled in the first place for it to be applicable and hence is not a passive threat unlike the JNDI-lookup vulnerability which the one identified appears to be.

Is my understanding - that Log4j v1.2 - is not vulnerable to the jndi-remote-code execution bug correct?

References

This blog post from Cloudflare also indicates the same point as from AKX....that it was introduced from Log4j 2!

Update #1 - A fork of the (now-retired) apache-log4j-1.2.x with patch fixes for few vulnerabilities identified in the older library is now available (from the original log4j author). The site is https://reload4j.qos.ch/. As of 21-Jan-2022 version 1.2.18.2 has been released. Vulnerabilities addressed to date include those pertaining to JMSAppender, SocketServer and Chainsaw vulnerabilities. Note that I am simply relaying this information. Have not verified the fixes from my end. Please refer the link for additional details.

...

ANSWER

Answered 2022-Jan-01 at 18:43

The JNDI feature was added into Log4j 2.0-beta9.

Log4j 1.x thus does not have the vulnerable code.

Source https://stackoverflow.com/questions/70310980

QUESTION

Syntax error with complicated postgresql sql query

Asked 2022-Jan-16 at 19:08

I need to insert multiple related tables simultaneously into postgres.

My query looks like

...

ANSWER

Answered 2022-Jan-16 at 19:08

I was misunderstanding how those temporary "tables" work. You still need to select from them as you would a normal table. I also rolled the three named subqueries from the 'findings' insert into anonymous subqueries inside the values, much cleaner.

Source https://stackoverflow.com/questions/70733163

QUESTION

hotfix securing many log4j jars against log4shell

Asked 2022-Jan-11 at 16:33

I have to secure some servers against CVE-2021-44228 aka log4shell. Those machines are running Linux and have a huge amount of log4j jars all over the place, some from app servers, some from legacy software, etc. I fear it is not possible to update all of them to the latest log4j.

However, if I understand correctly one can prevent log4shell in log4j 1.x by removing the impacted class like this:

...

ANSWER

Answered 2022-Jan-11 at 16:33

Well, here is my own shot at this. Not very elegant (quite repetitive), but with nicely colored output. And it only removes the class if the log4j version is compromised (FIX_VERSION="2.17.1" to also protect against CVE-2021-45105) and CVE-2021-44832.

Source https://stackoverflow.com/questions/70360767

QUESTION

Does the Log4j security violation vulnerability affect log4net?

Asked 2022-Jan-04 at 23:11

I have recently read about the zero-day issue in Log4J. I work with a few applications, written with .NET, that use the log4net logging library, which is based on Log4j.

Does log4net have any similar security vulnerabilities as the CVE-2021-44228 vulnerability to Log4j?

...

ANSWER

Answered 2022-Jan-04 at 23:00

Does log4net have any similar security vulnerabilities as the CVE-2021-44228 vulnerability to Log4j?

I don't believe so. If they did, it would be a coincidence. I don't think they share code.

Source https://stackoverflow.com/questions/70337145

QUESTION

How can I mitigate the Log4Shell vulnerability in version 1.2 of Log4j?

Asked 2022-Jan-02 at 21:01

I've got a very old version of Solr and I've been trying to see if it is affected by the Log4Shell vulnerability that everybody is freaking out about (CVE-2021-44228).

The CVE only seems to apply to later versions, but a colleague doesn't buy it, so I'm trying to figure out the truth.

...

ANSWER

Answered 2022-Jan-02 at 21:01

I'm about 95% sure this is fine for older versions of Log4j. Three reasons:

I'm on version 1.2. I found the Log4j JAR file on my system, unzipped it, and looked for anything mentioning JNDI:

Source https://stackoverflow.com/questions/70312033

QUESTION

How to mitigate Apache Log4j Deserialization RCE (CVE-2019-17571)

Asked 2021-Dec-21 at 11:38

I have upgraded my log4j-core dependency to 2.15.0 in order to prevent any potential Log4Shell attack. That being said I could not upgrade slf4j-log4j12's indirect log4j dependency from 1.2.17 since the latest stable version of slf4j-log4j12 is still dependent on log4j 1.2.17. This still leaves my webapp vulnerable to CVE-2019-17571 if I am not mistaken. So reading about possible mitigation strategies I came across this article which recommends to :

prevent the socket port enabled by the SocketServer class in Log4j from being opened to the public network

Could anyone please explain to me how can this be achieved and whether would this workaround be sufficient?

...

ANSWER

Answered 2021-Dec-17 at 07:58

Only servers that receive messages from other servers are vulnerable to CVE-2019-17571. Basically the only way to trigger the vulnerability is to run:

Source https://stackoverflow.com/questions/70345869

QUESTION

Is formsflow.ai being affected by log4shell vulnerability?

Asked 2021-Dec-20 at 04:42

Formsflow.ai is using Camunda, which is a java based application. So will formsflow.ai be affected by the latest log4shell vulnerability which is a very high risk vulnerability with CVE-2021-44228.

...

ANSWER

Answered 2021-Dec-20 at 04:42

No, formsflow.ai is not using log4j-core in the dependency stack. It uses only the following dependencies

Source https://stackoverflow.com/questions/70367082

QUESTION

How to find log4shell vulnerable classes in my assemblies (jar/ear/war)

Asked 2021-Dec-17 at 15:13

Around the current log4shell situation i need a way to find out if i have vulnerable classes in my packaged products. What is the easiest way to find if the following classes are contained in jar files packaged in EAR or WAR files?

JndiLookup.class
JMSAppenderBase.class
JMSAppender.class

...

ANSWER

Answered 2021-Dec-17 at 15:13

One solution would be the following bat script:

Source https://stackoverflow.com/questions/70395214

QUESTION

CVE-2021-44228 + slf4j + common-logging

Asked 2021-Dec-16 at 01:15

I am using slf4j in my project with the following :

...

ANSWER

Answered 2021-Dec-16 at 01:15

First of all, as mentioned in the SLF4J post you have linked, Log4j 1 is not affected by CVE-2021-44228 (but is end of life and affected by other vulnerabilities). Additionally it is marked as optional dependency so by default not included when you depend on common-logging, see the POM Reference and Introduction to the Dependency Mechanism, which mentions this as well:

It may be helpful to think of optional dependencies as "excluded by default."

Source https://stackoverflow.com/questions/70366204

QUESTION

Is slf4j affected by log4shell?

Asked 2021-Dec-14 at 02:09

Everyone is looking at log4j. Is the slf4j framework actually also affected by log4shell? I haven't found anything about it yet.

...

ANSWER

Answered 2021-Dec-14 at 02:09

please read their official statement http://slf4j.org/log4shell.html

in short: SLF4J is just a logging API, if your actual binding uses an affected log4j version then you're "in".

Source https://stackoverflow.com/questions/70341744

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install log4shell

You can download it from GitHub.
You can use log4shell like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.

Support

If you have any additional information to share relevant to the Log4j vulnerability, please feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.

Find more information at: