maven: migrate short-term to reload4j v1.2.18 by yadvr · Pull Request #5878 · apache/cloudstack

yadvr · 2022-01-19T12:35:30Z

This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in
replacement and addresses some immediate CVE and issues.

This will require some manual test of logging, as well as smoketests.

Fixes: (from https://reload4j.qos.ch/)
Standardize and sanitize the build - fixed in 1.2.18.0
CVE-2021-4104 (JMSAppender) - fixed in 1.2.18.0 by hardening
CVE-2022-23302 (JMSSink) - fixed in 1.2.18.1 by hardening
CVE-2019-17571 (SocketServer) - fixed in 1.2.18.0 by hardening
CVE-2020-9493 and CVE-2022-23307 (Chainsaw) - fixed in 1.2.18.1 by hardening
CVE-2022-23305 (JDBCAppender) - fixed in 1.2.18.2 by hardening the component.
broken MDC in newer JDKs - fixed in 1.2.18.0
XML entity injection attack - fixed in 1.2.18.3 by hardening
CVE-2020-9488 (SMTPAppender) fixed in 1.2.18.3 by hardening

This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in replacement and addresses some immediate CVE and issues. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

yadvr · 2022-01-31T07:12:12Z

@blueorangutan package

blueorangutan · 2022-01-31T07:13:03Z

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

yadvr · 2022-01-31T07:27:10Z

Tested locally, the build works - pl help review, advise on the PR cc @DaanHoogland @borisstoyanov @vladimirpetrov @sureshanaparti @nvazquez @weizhouapache @shwstppr @mlsorensen

weizhouapache · 2022-01-31T07:29:52Z

nice !
looking forward to packaging and smoke test results.

blueorangutan · 2022-01-31T07:49:34Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2396

DaanHoogland

looks good

DaanHoogland · 2022-01-31T07:51:22Z

 <dependency>
- <groupId>log4j</groupId>
- <artifactId>log4j</artifactId>
- <version>${cs.log4j.version}</version>


do we (still) need the version here?

Not sure, did n't want to refactor/experiment; so I've left all build config as is just replaced log4j with reload4j.

DaanHoogland · 2022-01-31T07:51:32Z

 <dependency>
- <groupId>log4j</groupId>
- <artifactId>log4j</artifactId>
- <version>${cs.log4j.version}</version>


do we (still) need the version here?

yadvr · 2022-02-01T06:06:06Z

@blueorangutan test

blueorangutan · 2022-02-01T06:07:03Z

@rohityadavcloud a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

blueorangutan · 2022-02-03T13:33:22Z

Trillian Build Failed (tid-3147)

blueorangutan · 2022-02-03T13:51:17Z

Trillian Build Failed (tid-3153)

blueorangutan · 2022-02-03T23:00:36Z

Trillian test result (tid-3146)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 32735 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3146-kvm-centos7.zip
Smoke tests completed. 92 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

blueorangutan · 2022-02-03T23:41:14Z

Trillian test result (tid-3148)
Environment: kvm-ubuntu20 (x2), Advanced Networking with Mgmt server 7
Total time taken: 34994 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3148-kvm-ubuntu20.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_migrate_VM_and_root_volume	`Error`	69.45	test_vm_life_cycle.py
test_02_migrate_VM_with_two_data_disks	`Error`	50.44	test_vm_life_cycle.py

mlsorensen · 2022-02-04T19:09:31Z

@rohityadavcloud - just looked at the dependency tree with this change. Do we need to move to slf4j 1.7.35? See https://www.slf4j.org/news.html

In this release, the "slf4j-log4j12" artifact automatically instructs Maven to use the "slf4j-reload4j" artifact instead. As you might have guessed, the "slf4j-reload4j" binding delegates log processing to the reload4j logging framework.

I'm also seeing esapi pulling in log4j 1.2.17, and contrail plugin pulling in log4j 1.2.16.

Co-authored-by: Marcus Sorensen <mls@apple.com>

yadvr · 2022-02-04T20:23:20Z

Thanks for the review @mlsorensen and the exclusion fix. I'll kick some tests.
@blueorangutan package

yadvr · 2022-02-04T20:33:23Z

@blueorangutan package

blueorangutan · 2022-02-04T20:34:03Z

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2022-02-04T21:10:15Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2466

sureshanaparti · 2022-02-05T12:34:42Z

@blueorangutan test matrix

blueorangutan · 2022-02-05T12:35:02Z

@sureshanaparti a Trillian-Jenkins matrix job (centos7 mgmt + xs71, centos7 mgmt + vmware65, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

blueorangutan · 2022-02-05T21:27:05Z

Trillian test result (tid-3174)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 30545 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3174-kvm-centos7.zip
Smoke tests completed. 92 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

blueorangutan · 2022-02-05T22:12:16Z

Trillian test result (tid-3173)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 33375 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3173-xenserver-71.zip
Smoke tests completed. 90 look OK, 2 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_sys_vm_start	`Failure`	0.09	test_secondary_storage.py
test_02_cancel_host_maintenace_with_migration_jobs	`Error`	19.91	test_host_maintenance.py
test_03_cancel_host_maintenace_with_migration_jobs_failure	`Error`	4.56	test_host_maintenance.py

blueorangutan · 2022-02-05T23:36:36Z

Trillian test result (tid-3175)
Environment: vmware-65u2 (x2), Advanced Networking with Mgmt server 7
Total time taken: 38556 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3175-vmware-65u2.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_02_upgrade_kubernetes_cluster	`Failure`	419.74	test_kubernetes_clusters.py

yadvr · 2022-02-07T06:17:11Z

cc @Pearl1594 are the k8s failures intermittent?
@blueorangutan package

blueorangutan · 2022-02-07T06:18:02Z

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2022-02-07T07:33:45Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✖️ suse15. SL-JID 2482

yadvr · 2022-02-07T07:39:24Z

@blueorangutan test centos7 vmware-67u3

Pearl1594 · 2022-02-07T07:45:19Z

cc @Pearl1594 are the k8s failures intermittent? @blueorangutan package

Based on the logs it seems to be due to :
unable to drain Kubernetes node on VM : testcluster-FDZXL0-control-17ecbae5fe8'
I haven't encountered this failure before, however, it may have been a one off occurrence wherein, the worker node may not be in ready state and the control node is being drained, which leaves the k8s with no other nodes to schedule pods on. Let's wait for the current test run to complete. If it fails yet again, I'll investigate it. Thanks

blueorangutan · 2022-02-07T07:47:03Z

@Pearl1594 a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2022-02-07T08:56:33Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2489

blueorangutan · 2022-02-07T21:52:24Z

Trillian test result (tid-3207)
Environment: kvm-rocky8 (x2), Advanced Networking with Mgmt server r8
Total time taken: 35063 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3207-kvm-rocky8.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_migrate_VM_and_root_volume	`Error`	85.20	test_vm_life_cycle.py
test_02_migrate_VM_with_two_data_disks	`Error`	49.60	test_vm_life_cycle.py

borisstoyanov

LGTM, managed to build/deploy this and run it with RockyLinux8(CentOS8 eq), centos7, ubuntu20, centos7-ev. There were no exceptions related to logging in management and agent logs.

maven: migrate short-term to reload4j v1.2.18
5de33d0
This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in replacement and addresses some immediate CVE and issues. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

yadvr marked this pull request as draft January 19, 2022 12:35

yadvr added 2 commits January 31, 2022 12:32

Merge remote-tracking branch 'origin/4.16' into log4j-short-term-remedy
5066ef3

log4j migration to reload4j in pom xmls
8ccb517
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

apache deleted a comment from blueorangutan Jan 31, 2022

yadvr marked this pull request as ready for review January 31, 2022 07:24

yadvr requested review from DaanHoogland, borisstoyanov, nvazquez, sureshanaparti and vladimirpetrov January 31, 2022 07:25

yadvr added this to the 4.16.1.0 milestone Jan 31, 2022

yadvr added component:logging Severity:Critical Critical bug labels Jan 31, 2022

DaanHoogland approved these changes Jan 31, 2022
View reviewed changes

apache deleted a comment from blueorangutan Jan 31, 2022

apache deleted a comment from blueorangutan Feb 1, 2022

Exclude log4j from transitive dependencies (#73)
cc027b5
Co-authored-by: Marcus Sorensen <mls@apple.com>

yadvr mentioned this pull request Feb 6, 2022
remove use of unsupported log4gv1 #5941
Closed

yadvr linked an issue Feb 6, 2022 that may be closed by this pull request
remove use of unsupported log4gv1 #5941
Closed

borisstoyanov approved these changes Feb 8, 2022
View reviewed changes

borisstoyanov removed their assignment Feb 8, 2022

sureshanaparti removed the status:needs-testing label Feb 8, 2022

sureshanaparti merged commit da56a2a into apache:4.16Feb 8, 2022

sureshanaparti added the type:security label Feb 8, 2022

Uh oh!

Conversation

yadvr commented Jan 19, 2022• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yadvr commented Jan 31, 2022

Uh oh!

blueorangutan commented Jan 31, 2022

Uh oh!

yadvr commented Jan 31, 2022

Uh oh!

weizhouapache commented Jan 31, 2022

Uh oh!

blueorangutan commented Jan 31, 2022

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHooglandJan 31, 2022

Choose a reason for hiding this comment

Uh oh!

yadvrJan 31, 2022

Choose a reason for hiding this comment

Uh oh!

DaanHooglandJan 31, 2022

Choose a reason for hiding this comment

Uh oh!

yadvr commented Feb 1, 2022

Uh oh!

blueorangutan commented Feb 1, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

mlsorensen commented Feb 4, 2022

Uh oh!

yadvr commented Feb 4, 2022

Uh oh!

yadvr commented Feb 4, 2022

Uh oh!

blueorangutan commented Feb 4, 2022

Uh oh!

blueorangutan commented Feb 4, 2022

Uh oh!

sureshanaparti commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

yadvr commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

yadvr commented Feb 7, 2022

Uh oh!

Pearl1594 commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

borisstoyanov left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

yadvr commented Jan 19, 2022•
edited
Loading