<![CDATA[Log4j and log4j2 library vulnerability]]>I'm not sure if you guys are tracking but unauthenticated RCE exploit just got dropped and is being exploited in the wild for log4j and log4j2 library.
This is used in a ton of products from apache struts to elasticsearch as the default logging framework.
Does cloudron use this and if so when can we get a patch?

]]>https://forum.cloudron.io/topic/6153/log4j-and-log4j2-library-vulnerabilityRSS for NodeSat, 11 Jul 2026 18:13:46 GMTFri, 10 Dec 2021 19:53:55 GMT60<![CDATA[Reply to Log4j and log4j2 library vulnerability on Wed, 29 Dec 2021 01:39:08 GMT]]>@girish ah i didnt even notice bevause of all the 4j notices my eyes where too open 🐶

thx for looking at this anyway

]]>https://forum.cloudron.io/post/41008https://forum.cloudron.io/post/41008Wed, 29 Dec 2021 01:39:08 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Tue, 28 Dec 2021 13:27:20 GMT]]>@3gal neo4j and log4j are different. the former is a database and the latter is logging library. Kutt anyway is written in typescript and not affected by log4j issue.

]]>https://forum.cloudron.io/post/40996https://forum.cloudron.io/post/40996Tue, 28 Dec 2021 13:27:20 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Mon, 27 Dec 2021 14:26:58 GMT]]>@nebulon I found log4j2 libary usage in kutt (urlshortener)

Standard config:

# ONLY NEEDED FOR MIGRATION !!1!
# Neo4j database credential details
NEO4J_DB_URI=bolt://localhost
NEO4J_DB_USERNAME=
NEO4J_DB_PASSWORD=

changed to this without errors:

# ONLY NEEDED FOR MIGRATION !!1!
# Neo4j database credential details
#NEO4J_DB_URI=bolt://localhost
#NEO4J_DB_USERNAME=neo4j
#NEO4J_DB_PASSWORD=BjEphmupAf1D5pDD

Is there anything else to do?
Is that even a issue?

]]>https://forum.cloudron.io/post/40965https://forum.cloudron.io/post/40965Mon, 27 Dec 2021 14:26:58 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sun, 26 Dec 2021 13:17:16 GMT]]>@mastadamus thanks alot, will try to implement this & will report under your post 🙂

]]>https://forum.cloudron.io/post/40934https://forum.cloudron.io/post/40934Sun, 26 Dec 2021 13:17:16 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 24 Dec 2021 15:35:12 GMT]]>@rmdes https://forum.cloudron.io/topic/6224/crowdsec-install-guide-for-cloudron-purposes

]]>https://forum.cloudron.io/post/40907https://forum.cloudron.io/post/40907Fri, 24 Dec 2021 15:35:12 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Thu, 23 Dec 2021 15:35:46 GMT]]>@rmdes I'll put one together later tonight.

]]>https://forum.cloudron.io/post/40860https://forum.cloudron.io/post/40860Thu, 23 Dec 2021 15:35:46 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Thu, 23 Dec 2021 11:32:07 GMT]]>@mastadamus do you have a step by step instructions to setup crowdsec in a cloudron context ?

]]>https://forum.cloudron.io/post/40851https://forum.cloudron.io/post/40851Thu, 23 Dec 2021 11:32:07 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sat, 18 Dec 2021 04:08:27 GMT]]>@mastadamus I'm happy to report that Crowdsec successfully responded to a log4j exploit scanner. If you set up your nginx log configuration per my post in support, and install the nginx collection as well as the log4j2 collection with an firewall iptable bouncer it will auto block any ip belonging to an attempt it parses out.

crowdsec crowdsecurity/apache_log4j2_cve-2021-44228 Ip 45.83.65.33 2021-12-17 07:55:25 2021-12-17 07:55:25

]]>https://forum.cloudron.io/post/40692https://forum.cloudron.io/post/40692Sat, 18 Dec 2021 04:08:27 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 19:11:30 GMT]]>@rmdes good suggestion.

]]>https://forum.cloudron.io/post/40679https://forum.cloudron.io/post/40679Fri, 17 Dec 2021 19:11:30 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 19:10:56 GMT]]>@girish min patch to rectify log4j2 issues is 2.16 .. 2.15 is affected by cvss 9.0 rce in some instances.

]]>https://forum.cloudron.io/post/40678https://forum.cloudron.io/post/40678Fri, 17 Dec 2021 19:10:56 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 15:42:46 GMT]]>I am aware of solr being detected by the static analyzers (the marketplace images complain about the same). solr is used internally for full text search in the mail container. It's not on by default and it's also not exposed outside the internal docker network (so not exposed to outside world).

Still, we will update the mail container. Solr only put out a new release yesterday which update log4j.

]]>https://forum.cloudron.io/post/40662https://forum.cloudron.io/post/40662Fri, 17 Dec 2021 15:42:46 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 15:16:54 GMT]]>@necrevistonnezr ah ok, then this is fine. It is not exposed or anything.

]]>https://forum.cloudron.io/post/40656https://forum.cloudron.io/post/40656Fri, 17 Dec 2021 15:16:54 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 15:15:06 GMT]]>@nebulon The only SOLR instance is the Cloudron internal mail indexing, in my case.

]]>https://forum.cloudron.io/post/40654https://forum.cloudron.io/post/40654Fri, 17 Dec 2021 15:15:06 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 14:24:57 GMT]]>@brutalbirdie just because the library is used, does not mean the app is actually vulnerable. In either case all we can really do from our side is to closely track upstream releases during such times and release new app packages asap. We usually can't really patch the upstream apps easily. In this case it seem to be prometheus related? @necrevistonnezr do you know to which app those layers in your case are related to?

]]>https://forum.cloudron.io/post/40649https://forum.cloudron.io/post/40649Fri, 17 Dec 2021 14:24:57 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 11:29:35 GMT]]>@nebulon ping
Can you check that out?

]]>https://forum.cloudron.io/post/40644https://forum.cloudron.io/post/40644Fri, 17 Dec 2021 11:29:35 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Fri, 17 Dec 2021 11:06:49 GMT]]>@girish I ran https://github.com/mergebase/log4j-detector today and it seems that at least SOLR is vulnerable(?)

/proc/5961/task/9300/cwd/lib/ext/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_ :-(
/var/lib/docker/overlay2/32ab0d12f3342918d0ffea4a1392cb760f852f9bf0a219c682dd366ff26e72bc/diff/usr/share/java/log4j-1.2-1.2.17.jar contains Log4J-1.x   <= 1.2.17 _OLD_ :-|
/var/lib/docker/overlay2/5bb4ce30d32c6760fe21e98ab6f98651bf9591e83ab2385f0a4833ee5ef0c979/diff/app/code/solr/contrib/prometheus-exporter/lib/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_ :-(
/var/lib/docker/overlay2/5bb4ce30d32c6760fe21e98ab6f98651bf9591e83ab2385f0a4833ee5ef0c979/diff/app/code/solr/server/lib/ext/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_ :-(
/var/lib/docker/overlay2/f8ed382cc2590afd6189335f84aaf0f561811a5165dbf58191be61048c5312f5/merged/app/code/solr/contrib/prometheus-exporter/lib/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_ :-(
/var/lib/docker/overlay2/f8ed382cc2590afd6189335f84aaf0f561811a5165dbf58191be61048c5312f5/merged/app/code/solr/server/lib/ext/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_ :-(
]]>https://forum.cloudron.io/post/40642https://forum.cloudron.io/post/40642Fri, 17 Dec 2021 11:06:49 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Thu, 16 Dec 2021 17:13:39 GMT]]>"Log4j 2.15.0 and previously suggested mitigations may not be enough" - https://isc.sans.edu/diary/Log4j+2.15.0+and+previously+suggested+mitigations+may+not+be+enough/28134

]]>https://forum.cloudron.io/post/40610https://forum.cloudron.io/post/40610Thu, 16 Dec 2021 17:13:39 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Mon, 13 Dec 2021 09:51:29 GMT]]>This tool is also neat, with or without cloudron context : https://github.com/fullhunt/log4j-scan

]]>https://forum.cloudron.io/post/40425https://forum.cloudron.io/post/40425Mon, 13 Dec 2021 09:51:29 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Mon, 13 Dec 2021 09:47:49 GMT]]>Docker Scan should allow us to scan cloudron containers if any doubt remains :
https://www.docker.com/blog/apache-log4j-2-cve-2021-44228/

edit : https://github.com/docker/scan-cli-plugin/releases/tag/v0.11.0

]]>https://forum.cloudron.io/post/40424https://forum.cloudron.io/post/40424Mon, 13 Dec 2021 09:47:49 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Mon, 13 Dec 2021 09:12:06 GMT]]>Here's a maintained list with log4j advisories: https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592

log4j detector: https://github.com/mergebase/log4j-detector

"Vaccine": https://www.bleepingcomputer.com/news/security/researchers-release-vaccine-for-critical-log4shell-vulnerability/

]]>https://forum.cloudron.io/post/40422https://forum.cloudron.io/post/40422Mon, 13 Dec 2021 09:12:06 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sun, 12 Dec 2021 16:19:42 GMT]]>@privsec I tested nextcloud with a log4j2 testing tool from huntress and I couldn't get it to callback to the ldap server so i think its gtg.

]]>https://forum.cloudron.io/post/40399https://forum.cloudron.io/post/40399Sun, 12 Dec 2021 16:19:42 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sat, 11 Dec 2021 21:22:36 GMT]]>@privsec I'm already receiving exploit/scan attempts inbound. No successful exploits. I believe nothing in my cloudron stack uses it. I can't find any confirmation nextcloud does. If you find something i'd love it asap.

]]>https://forum.cloudron.io/post/40392https://forum.cloudron.io/post/40392Sat, 11 Dec 2021 21:22:36 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sat, 11 Dec 2021 20:14:48 GMT]]>Nextcloud, mincraft, use this, right?

]]>https://forum.cloudron.io/post/40391https://forum.cloudron.io/post/40391Sat, 11 Dec 2021 20:14:48 GMT<![CDATA[Reply to Log4j and log4j2 library vulnerability on Sat, 11 Dec 2021 17:59:59 GMT]]>@jdaviescoates Its heavily weaponized. Like if you have an app thats affected chances are its going to get popped if you leave it unmitigated. Broad array of actors are exploiting it.. from coin miners to more advanced threats. Grey noise is tracking the IP's associated with the threat campaigns and right now they are numerous.

]]>https://forum.cloudron.io/post/40388https://forum.cloudron.io/post/40388Sat, 11 Dec 2021 17:59:59 GMT