Is netxms affected by CVE-2021-44228?

Reply to Is netxms affected by CVE-2021-44228? on Wed, 15 Dec 2021 15:48:29 GMT

lweidig — Wed, 15 Dec 2021 15:48:29 GMT

Excellent! I suspected that was the case as well and appreciate you confirming this.

Reply to Is netxms affected by CVE-2021-44228? on Wed, 15 Dec 2021 15:37:08 GMT

alk — Wed, 15 Dec 2021 15:37:08 GMT

Jython is used by nxshell.

However, the only mentions of log4j I've found in the jython is adapters to different logging frameworks (in org.python.netty.util.internal.logging), not the log4j runtime itself.

@lweidig said in Is netxms affected by CVE-2021-44228?:

A recent scan of our NetXMS VM shows the following:
[WARNING] /usr/lib/x86_64-linux-gnu/netxms/java/jython-standalone-2.7.2.jar contains log4j files
Curious where this is all used and what the solution might be if this is an issue. We are running the latest version of NetXMS and also do run the web console. Thanks!

You can verify yourself, that there are no JndiLookup (which is affected piece of log4j2):

~
❯ unzip -t ~/.m2/repository/org/python/jython-standalone/2.7.2/jython-standalone-2.7.2.jar | grep JndiLookup
~
❯ echo $status
1
~
❯

Reply to Is netxms affected by CVE-2021-44228? on Wed, 15 Dec 2021 13:42:23 GMT

lweidig — Wed, 15 Dec 2021 13:42:23 GMT

A recent scan of our NetXMS VM shows the following:

[WARNING] /usr/lib/x86_64-linux-gnu/netxms/java/jython-standalone-2.7.2.jar contains log4j files

Curious where this is all used and what the solution might be if this is an issue. We are running the latest version of NetXMS and also do run the web console. Thanks!

Reply to Is netxms affected by CVE-2021-44228? on Sat, 11 Dec 2021 02:47:14 GMT

normalcy — Sat, 11 Dec 2021 02:47:14 GMT

Thanks Alex, I'm assuming I've got jetty on that VM from testing out the nxmc web console in the past. Seems the 1.x series on my VM is not vulnerable to this CVE in any case.

Reply to Is netxms affected by CVE-2021-44228? on Sat, 11 Dec 2021 00:09:13 GMT

alk — Sat, 11 Dec 2021 00:09:13 GMT

Hello.

NetXMS does not use log4j (neither jetty9).

Test, which shows that on the clean system there are no log4j jars:

❯ docker run --rm -it debian:11 bash
root@f7dddcf8abfe:/# apt-get update
…
root@f7dddcf8abfe:/# apt-get install -y curl
…
root@f7dddcf8abfe:/# curl https://packages.netxms.org/install | sh
…
root@f7dddcf8abfe:/# apt-get install -fy
…
root@f7dddcf8abfe:/# apt-get update
…
root@f7dddcf8abfe:/# apt-get install -y netxms-\* jetty9
…
root@f7dddcf8abfe:/# find / -name \*log4j\*
/usr/share/jetty9/modules/logging-log4j.mod
/usr/share/jetty9/modules/logging-log4j2.mod
/usr/share/jetty9/modules/log4j2-impl.mod
/usr/share/jetty9/modules/log4j-impl
/usr/share/jetty9/modules/log4j-impl/resources/log4j.xml
/usr/share/jetty9/modules/slf4j-log4j2.mod
/usr/share/jetty9/modules/log4j2-api.mod
/usr/share/jetty9/modules/log4j2-slf4j.mod
/usr/share/jetty9/modules/log4j2-impl
/usr/share/jetty9/modules/log4j2-impl/resources/log4j2.xml
/usr/share/jetty9/modules/log4j-impl.mod
/usr/share/jetty9/modules/slf4j-log4j.mod
root@f7dddcf8abfe:/#

Reply to Is netxms affected by CVE-2021-44228? on Fri, 10 Dec 2021 22:42:05 GMT

normalcy — Fri, 10 Dec 2021 22:42:05 GMT

This github repo has hashes of vulnerable versions of the library and the link to the apache repo suggest ver 1.x might also be vulnerable too.

I'm guessing installing jetty for the web console is what brings in log4j dependencies?