We are building an app based on Red Hat JBoss AMQ 6. We wrap some Java code around the base image to provide extra functionalities which are lacking in AMQ 6.
Now, when the CVE of Log4j stroke, we found that this component is vulnerable because it uses log4j 1.x. Now I don't just mean our Java code uses it, but also the base image of Red Hat AMQ 6 uses it. As AMQ 6 is EOL now, Red Hat does not provide support anymore, so there will not be official releases with fix.
So, how do I remove vulnerable log4j 1.x classes from:
?
I am building with jib maven plugin.
It seems mvn dependency:tree only gives info about our Java wrapper code, not about the base image. And I don't understand what does the "+" and "-" mean while it gives output like this:
[INFO] +- org.jboss.resteasy:resteasy-jaxrs:jar:3.7.0.Final:compile
[INFO] | +- org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_2.1_spec:jar:1.0.2.Final:compile
[INFO] | +- org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.3_spec:jar:1.0.1.Final:compile
[INFO] | +- org.reactivestreams:reactive-streams:jar:1.0.2:compile
[INFO] | +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] | +- org.jboss.spec.javax.annotation:jboss-annotations-api_1.3_spec:jar:1.0.1.Final:compile
[INFO] | +- javax.activation:activation:jar:1.1.1:compile
[INFO] | +- org.apache.httpcomponents:httpclient:jar:4.5.4:compile
[INFO] | | +- org.apache.httpcomponents:httpcore:jar:4.4.7:compile
[INFO] | | +- commons-logging:commons-logging:jar:1.2:compile
[INFO] | | \- commons-codec:commons-codec:jar:1.10:compile
[INFO] | +- commons-io:commons-io:jar:2.5:compile
[INFO] | +- net.jcip:jcip-annotations:jar:1.0:compile
[INFO] | \- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
Does + mean that it can be expanded further but is not shown here?
Some background here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228
You can use:
mvn dependency:tree -Dincludes=*log4j*
It will find any dependencies and transitive dependencies having "log4j" anywhere in its groupId.
Example of output:
\- org.springframework.boot:spring-boot-starter-web:jar:2.6.0:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.6.0:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.6.0:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.14.1:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.14.1:compile
Each pattern segment is optional and supports full and partial * wildcards. An empty pattern segment is treated as an implicit wildcard.
For example, org.apache.* would match all artifacts whose group id started with org.apache., and :::*-SNAPSHOT would match all snapshot artifacts.
See also maven doc
EDIT
You then most probably would want then exclude these dependencies with:
<dependency>
<groupId>your dep groupId</groupId>
<artifactId>your dep artifactId</artifactId>
<exclusions>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-to-slf4j</artifactId>
</exclusion>
</exclusions>
</dependencies>
Notes
At the time of writting, it is any version < 2.17.1
Log4j versions with vulnerabilites are available on Maven Repository