maven: migrate short-term to reload4j v1.2.18 by yadvr · Pull Request #5878 · apache/cloudstack · GitHub

This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in
replacement and addresses some immediate CVE and issues.

This will require some manual test of logging, as well as smoketests.

Fixes: (from https://reload4j.qos.ch/)
Standardize and sanitize the build - fixed in 1.2.18.0
CVE-2021-4104 (JMSAppender) - fixed in 1.2.18.0 by hardening
CVE-2022-23302 (JMSSink) - fixed in 1.2.18.1 by hardening
CVE-2019-17571 (SocketServer) - fixed in 1.2.18.0 by hardening
CVE-2020-9493 and CVE-2022-23307 (Chainsaw) - fixed in 1.2.18.1 by hardening
CVE-2022-23305 (JDBCAppender) - fixed in 1.2.18.2 by hardening the component.
broken MDC in newer JDKs - fixed in 1.2.18.0
XML entity injection attack - fixed in 1.2.18.3 by hardening
CVE-2020-9488 (SMTPAppender) fixed in 1.2.18.3 by hardening

This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in replacement and addresses some immediate CVE and issues. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

@blueorangutan package

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Tested locally, the build works - pl help review, advise on the PR cc @DaanHoogland @borisstoyanov @vladimirpetrov @sureshanaparti @nvazquez @weizhouapache @shwstppr @mlsorensen

nice !
looking forward to packaging and smoke test results.

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2396

looks good

do we (still) need the version here?

Not sure, did n't want to refactor/experiment; so I've left all build config as is just replaced log4j with reload4j.

do we (still) need the version here?

@blueorangutan test

@rohityadavcloud a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

Trillian Build Failed (tid-3147)

Trillian Build Failed (tid-3153)

Trillian test result (tid-3146)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 32735 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3146-kvm-centos7.zip
Smoke tests completed. 92 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

Trillian test result (tid-3148)
Environment: kvm-ubuntu20 (x2), Advanced Networking with Mgmt server 7
Total time taken: 34994 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3148-kvm-ubuntu20.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_migrate_VM_and_root_volume	Error	69.45	test_vm_life_cycle.py
test_02_migrate_VM_with_two_data_disks	Error	50.44	test_vm_life_cycle.py

@rohityadavcloud - just looked at the dependency tree with this change. Do we need to move to slf4j 1.7.35? See https://www.slf4j.org/news.html

In this release, the "slf4j-log4j12" artifact automatically instructs Maven to use the "slf4j-reload4j" artifact instead. As you might have guessed, the "slf4j-reload4j" binding delegates log processing to the reload4j logging framework.

I'm also seeing esapi pulling in log4j 1.2.17, and contrail plugin pulling in log4j 1.2.16.

Co-authored-by: Marcus Sorensen <mls@apple.com>

Thanks for the review @mlsorensen and the exclusion fix. I'll kick some tests.
@blueorangutan package

@blueorangutan package

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2466

@blueorangutan test matrix

@sureshanaparti a Trillian-Jenkins matrix job (centos7 mgmt + xs71, centos7 mgmt + vmware65, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

Trillian test result (tid-3174)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 30545 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3174-kvm-centos7.zip
Smoke tests completed. 92 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

Trillian test result (tid-3173)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 33375 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3173-xenserver-71.zip
Smoke tests completed. 90 look OK, 2 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_sys_vm_start	Failure	0.09	test_secondary_storage.py
test_02_cancel_host_maintenace_with_migration_jobs	Error	19.91	test_host_maintenance.py
test_03_cancel_host_maintenace_with_migration_jobs_failure	Error	4.56	test_host_maintenance.py

Trillian test result (tid-3175)
Environment: vmware-65u2 (x2), Advanced Networking with Mgmt server 7
Total time taken: 38556 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3175-vmware-65u2.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_02_upgrade_kubernetes_cluster	Failure	419.74	test_kubernetes_clusters.py

cc @Pearl1594 are the k8s failures intermittent?
@blueorangutan package

@rohityadavcloud a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✖️ suse15. SL-JID 2482

@blueorangutan test centos7 vmware-67u3

cc @Pearl1594 are the k8s failures intermittent? @blueorangutan package

Based on the logs it seems to be due to :
unable to drain Kubernetes node on VM : testcluster-FDZXL0-control-17ecbae5fe8'
I haven't encountered this failure before, however, it may have been a one off occurrence wherein, the worker node may not be in ready state and the control node is being drained, which leaves the k8s with no other nodes to schedule pods on. Let's wait for the current test run to complete. If it fails yet again, I'll investigate it. Thanks

@Pearl1594 a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2489

Trillian test result (tid-3207)
Environment: kvm-rocky8 (x2), Advanced Networking with Mgmt server r8
Total time taken: 35063 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5878-t3207-kvm-rocky8.zip
Smoke tests completed. 91 look OK, 1 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_migrate_VM_and_root_volume	Error	85.20	test_vm_life_cycle.py
test_02_migrate_VM_with_two_data_disks	Error	49.60	test_vm_life_cycle.py

LGTM, managed to build/deploy this and run it with RockyLinux8(CentOS8 eq), centos7, ubuntu20, centos7-ev. There were no exceptions related to logging in management and agent logs.

maven: migrate short-term to reload4j v1.2.18

5de33d0

This migrate to log4j 1.x fork, reload4j 1.2.18.0 which is drop-in replacement and addresses some immediate CVE and issues. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

yadvr marked this pull request as draft January 19, 2022 12:35

yadvr added 2 commits January 31, 2022 12:32

Merge remote-tracking branch 'origin/4.16' into log4j-short-term-remedy

5066ef3

log4j migration to reload4j in pom xmls

8ccb517

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

apache deleted a comment from blueorangutan Jan 31, 2022

yadvr marked this pull request as ready for review January 31, 2022 07:24

yadvr requested review from DaanHoogland, borisstoyanov, nvazquez, sureshanaparti and vladimirpetrov January 31, 2022 07:25

yadvr added this to the 4.16.1.0 milestone Jan 31, 2022

yadvr added component:logging Severity:Critical Critical bug labels Jan 31, 2022

DaanHoogland approved these changes Jan 31, 2022

View reviewed changes

apache deleted a comment from blueorangutan Jan 31, 2022

apache deleted a comment from blueorangutan Feb 1, 2022

Exclude log4j from transitive dependencies (#73 )

cc027b5

Co-authored-by: Marcus Sorensen <mls@apple.com>

yadvr mentioned this pull request Feb 6, 2022

remove use of unsupported log4gv1 #5941

Closed

yadvr linked an issue Feb 6, 2022 that may be closed by this pull request

remove use of unsupported log4gv1 #5941

Closed

borisstoyanov approved these changes Feb 8, 2022

View reviewed changes

borisstoyanov removed their assignment Feb 8, 2022

sureshanaparti removed the status:needs-testing label Feb 8, 2022

sureshanaparti merged commit da56a2a into apache:4.16 Feb 8, 2022

sureshanaparti added the type:security label Feb 8, 2022

                       <dependency>
-                          <groupId>log4j</groupId>
-                          <artifactId>log4j</artifactId>
-                          <version>${cs.log4j.version}</version>

                       <dependency>
-                          <groupId>log4j</groupId>
-                          <artifactId>log4j</artifactId>
-                          <version>${cs.log4j.version}</version>

maven: migrate short-term to reload4j v1.2.18 by yadvr · Pull Request #5878 · apache/cloudstack · GitHub

Repository navigation

maven: migrate short-term to reload4j v1.2.18 - #5878

maven: migrate short-term to reload4j v1.2.18#5878sureshanaparti merged 4 commits intoapache:4.16apache/cloudstack:4.16from shapeblue:log4j-short-term-remedyshapeblue/cloudstack:log4j-short-term-remedyCopy head branch name to clipboard

Conversation

yadvr commented Jan 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yadvr commented Jan 31, 2022

Uh oh!

blueorangutan commented Jan 31, 2022

Uh oh!

yadvr commented Jan 31, 2022

Uh oh!

weizhouapache commented Jan 31, 2022

Uh oh!

blueorangutan commented Jan 31, 2022

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland Jan 31, 2022

Choose a reason for hiding this comment

Uh oh!

yadvr Jan 31, 2022

Choose a reason for hiding this comment

Uh oh!

DaanHoogland Jan 31, 2022

Choose a reason for hiding this comment

Uh oh!

yadvr commented Feb 1, 2022

Uh oh!

blueorangutan commented Feb 1, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

blueorangutan commented Feb 3, 2022

Uh oh!

mlsorensen commented Feb 4, 2022

Uh oh!

yadvr commented Feb 4, 2022

Uh oh!

yadvr commented Feb 4, 2022

Uh oh!

blueorangutan commented Feb 4, 2022

Uh oh!

blueorangutan commented Feb 4, 2022

Uh oh!

sureshanaparti commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

blueorangutan commented Feb 5, 2022

Uh oh!

yadvr commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

yadvr commented Feb 7, 2022

Uh oh!

Pearl1594 commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

blueorangutan commented Feb 7, 2022

Uh oh!

borisstoyanov left a comment

Choose a reason for hiding this comment

maven: migrate short-term to reload4j v1.2.18#5878
sureshanaparti merged 4 commits into
apache:4.16from
shapeblue:log4j-short-term-remedy

yadvr commented Jan 19, 2022 •
edited
Loading