Is Confluent (7.0) with bundled LOG4J vulnerability?

DevOps Kafka
#1

Hi. Is the current version of Confluent (7.0) and the bundled LOG4J version, open to this new vulnerability ?
https://www.randori.com/blog/cve-2021-44228/

#2

According to https://docs.confluent.io/platform/current/release-notes/index.html , yes. https://twitter.com/lizthegrey/status/1469143322811777032 has the mitigation required.

#3

Would the mitigation suggested here with this property on broker log4j.properties work?

-Dlog4j2.formatMsgNoLookups=true

https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

#4

That’s a jvm argument. And it should work

#5

Yup, KAFKA_ARGS should be able to take it in your service file

#6

-Dlog4j2.formatMsgNoLookups=true in log4j.properties confirms working preventing log4j2 vulnerability log4shell.

#7

Thanks for all the good info people!

#8

Where do you see that Confluent Kafka is vulnerable? Core Kafka uses log4j 1.2.17. As far as I can tell, Confluent uses a repackaged version of log4j 1.2 with security patches.

#9

PR-365 - Upgrade log4j2 to 2.13.2 PR-371 - KAFKA-12756: Update ZooKeeper to v3.6.3

#10

If you have a confluent support contract I strongly recommend checking out https://support.confluent.io/hc/en-us/articles/4412607023124-Security-Release-Notes-for-CP-7-0-1

#11

For Confluent Cloud customers, is there a way to view what version the cluster is running so we can confirm the security patches have been applied?