We are using jetty9.4.43 in our application. Logging modules not being used by default.
Can any one confirm whether jetty9.4.43 has any impact over CVE-2021-44228?
1 Answers
Update: Dec 18, 2021
There is a new Log4j CVE just issued. https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
Minimum recommended Log4j version is now 2.17.0.
Update: Dec 13, 2021
There is a new Log4J CVE issued. https://access.redhat.com/security/cve/cve-2021-45046
Minimum recommended Log4j version is now 2.16.0
Original Text
Also covered at https://webtide.com/jetty-log4j2-exploit-cve-2021-44228/
Jetty has no direct dependency on log4j.
Jetty 9.x uses it's own logging framework StdErrLog, and has optional support for slf4j.
You, as a consumer of Jetty, can choose to use slf4j and then optionally take the next step and use log4j within that slf4j configuration.
So, while it's possible to use log4j 1.x or 2.x on Jetty 9.x, it's a decision that users choose to make, and it's up to the users to decide what they want to do. (Eg: upgrade to log4j 2.16.0 to satisfy both recent CVEs, or switch to a different logging framework like logback)
Waiting for a new release of Jetty is not necessary to address this CVE.
Also note that the log4j2 CVE does not impact users on Java 11.0.2 or newer, as the internal JVM property com.sun.jndi.ldap.object.trustURLCodebase is set to false by default starting with Java 11.0.2, which disables JNDI loading of classes from arbitrary URL code bases. (Users on Java 8 have more work than users on Java 11.0.2 or newer)
Eclipse Jetty Security Reports
All verified security reports for Eclipse Jetty can be found at ...
https://www.eclipse.org/jetty/security_reports.php
Github tracked and published advisories can be found at ...
https://github.com/eclipse/jetty.project/security/advisories?state=published
Related