log4j漏洞对Apache项目影响一览表以及cdh、hdp对于漏洞的修复方法
艾令雪
Apache Log4j2 <=2.14.1 在配置、日志消息和参数中使用的 JNDI 功能不能防止攻击者控制的 LDAP 和其他 JNDI 相关端点。 当启用消息查找替换时，可以控制日志消息或日志消息参数的攻击者可以执行从 LDAP 服务器加载的任意代码。 从 log4j 2.15.0 开始，默认情况下已禁用此行为。 在以前的版本 (>2.10) 中，可以通过将系统属性“log4j2.formatMsgNoLookups”设置为“true”来缓解这种行为，或者可以通过从类路径中删除 JndiLookup 类（例如：zip - q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class）。
下述项目列出了 log4j CVE-2021-44228对Apache项目的影响
| Project | Status |
|---|---|
| Apache Archiva | Affected, release 2.2.6 will address this |
| Apache Calcite Avatica | Affected, update to 1.20.0 |
| Apache Camel | Not affected |
| Apache CloudStack | Not Affected |
| Apache Druid | Affected, update to 0.22.1 |
| Apache EventMesh | Affected |
| Apache Flink | Affected |
| Apache Fortress | Affected, update to 2.0.7 |
| Apache Geode | Affected, update to 1.12.6, 1.13.5, 1.14.1 |
| Apache Guacamole | Not Affected |
| Apache Hadoop | Not affected, uses log4j 1.x |
| Apache Hive | Affected |
| Apache HTTP Server (httpd) | Not affected |
| Apache Iceberg | Not Affected |
| Apache Jena | Affected, update to 4.3.1 |
| Apache JMeter | Affected |
| Apache JSPWiki | Affected |
| Apache Log4J 1.2 | Not Affected, see CVE-2021-4104. Note Log4j 1.x is EOL since 2015. |
| Apache Log4J 2.x | Affected, update to 2.16.0 |
| Apache Log4Net | Not affected |
| Apache Maven | Not affected, Maven 3.1+ uses lsf4j simple-logger |
| Apache OFBiz | Affected, update to 18.12.03 |
| Apache Ozone | Affected, update to 1.2.1 |
| Apache SkyWalking | Affected, update to 8.9.1 |
| Apache Solr | Affected, update to 8.11.1 |
| Apache Spark | Not affected, uses log4j 1.x |
| Apache Struts | Affected |
| Apache Tomcat | Not Affected |
| Apache TrafficControl | Affected |
| Apache ZooKeeper | Not affected, uses log4j 1.x |
cdh以及hdp对于log4j漏洞修复方法
参考：https://github.com/cloudera/cloudera-scripts-for-log4j
类似资料：