Fixing the Log4j2 vulnerability in spring boot application

 Hi all,

Software Industry was in a shock with the log4j2 zero day exploit.

Exploited area

The Apache Log4j2 version ( >=2.0 to <=2.14.1 ) is exploitable due to an attacker controlled LDAP and  JNDI endpoints.

Appendix

LDAP (Light Weight Directory Protocol) is an industry standard protocol to access directory services.

JNDI (Java Naming and Directory Interface) is a Java API for a directory service that allows Java software clients to discover and look up data and resources via a name.

Find more information about the vulnerability from NVD website link.

https://nvd.nist.gov/vuln/detail/CVE-2021-44228

NVD (National Vulnerability Database) is maintained by National Institute of Standards and Technology (NIST),  An official part of United States of America (USA) government's Department of Commerce.

Fix the vulnerability

• Even in the latest spring boot package uses the vulnerable 2.14.1 log4j2 version.
• So, we need to explicitly add the specific version in the properties as below
• In pom.xml file, creating <properties> tag if not exists and add the attribute log4j2.version with version 2.16.0 (latest)

<properties>

    <log4j2.version>2.16.0</log4j2.version>

</properties>

• To check the version applied to the project, run the following command

mvn dependency:tree | grep "log4j"

• The result should look like below

[INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.16.0:compile

[INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.16.0:compile

• The similar type of vulnerability fixes available for other project builds.

Hope you will find the above information useful and fix the issue immediately to keep the servers safe from attacks.

Send your valuable feedback and comments to psrdotcom@gmail.com

 

Create and Apply Patch file in Linux using Diff command

Hi friends,

When I was updating one file, I have taken backup as filename_old.

After updating (adding and removing line) the current file, I thought let me see what are all the updates I have done to the current file. Then I thought, there is a concept call patch file.

Then I decided to create the patch file.

I have searched and surprised that "diff" command is able to do that.

Procedure:

Files: 1.txt (Original File), 2.txt (Modified File), diff.patch (Patch File)

1.txt	2.txt
a	a
b	b
c	c
d	e
e	f
f	g
1

Create Patch


Syntax: diff -Naur Original_File Modified_File > Patch_File

In terminal window, execute the following command

$ diff -Naur 1.txt 2.txt >> diff.patch


Output:

diff.patch


--- 1.txt 2012-06-01 23:25:02.713727335 +0530
+++ 2.txt 2012-06-01 23:25:09.833727317 +0530
@@ -1,7 +1,6 @@
 a
 b
 c
-d
 e
 f
-1
+g




Apply Patch

Syntax: patch -u Original_File Patch_File


$ patch -u 1.txt diff.patch


Output:

1.txt

a

b

c

e

f

g

Now, we have successfully applied the patch to the old (Original) file.

Please send your feedback to psrdotcom@gmail.com or write comments