scala log4j 漏洞

Posted 2023-02-18

【中文标题】scala log4j 漏洞

【英文标题】：scala log4j vulnerability

【发布时间】：2022-01-22 09:33:15

【问题描述】：

我在 pom.xml 中使用以下 scala 依赖项，但它给出了 log4j 漏洞错误。

 <properties>
        <maven.compiler.source>1.8</maven.compiler.source>
        <maven.compiler.target>1.8</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <scala.major.version>2.11</scala.major.version>
        <scala.minor.version>2.11.12</scala.minor.version>
        <gridgain.version>8.7.8</gridgain.version>
        <ignite.version>2.7.0</ignite.version>
        <spark.version>2.3.0</spark.version>
        <spring.boot.version>2.4.0</spring.boot.version>
        <maven-release-plugin-version>2.5.3</maven-release-plugin-version>
        <maven-assembly-plugin-version>3.1.1</maven-assembly-plugin-version>
 </properties>



 <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.gridgain</groupId>
                <artifactId>gridgain-core</artifactId>
                <version>$gridgain.version</version>
            </dependency>
            <dependency>
                <groupId>org.gridgain</groupId>
            <artifactId>ignite-spring</artifactId>
                <version>$gridgain.version</version>
            </dependency>
            <dependency>
                <groupId>org.gridgain</groupId>
                <artifactId>ignite-indexing</artifactId>
                <version>$gridgain.version</version>
            </dependency>
            <dependency>
                <groupId>org.gridgain</groupId>
                <artifactId>ignite-log4j2</artifactId>
                <version>$gridgain.version</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>2.1.3.RELEASE</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        <dependency>
                <groupId>com.typesafe.scala-logging</groupId>
                <artifactId>scala-logging_$scala.major.version</artifactId>
                <version>3.9.0</version>
            </dependency>
            <dependency>
                <groupId>org.scalatest</groupId>
                <artifactId>scalatest_$scala.major.version</artifactId>
                <version>3.0.4</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-library</artifactId>
                <version>$scala.minor.version</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-reflect</artifactId>
                <version>$scala.minor.version</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.surefire</groupId>
                <artifactId>surefire-junit4</artifactId>
                <version>2.22.1</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.scalatest</groupId>
            <artifactId>scalatest_$scala.major.version</artifactId>
    </dependency>
    </dependencies>
    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                      <artifactId>maven-release-plugin</artifactId>
                      <version>2.5.3</version>   
                </plugin>
                <plugin>
                    <groupId>net.alchim31.maven</groupId>
                    <artifactId>scala-maven-plugin</artifactId>
                    <version>4.0.1</version>
                    <executions>
                        <execution>
                            <goals>
                                <goal>compile</goal>
                                <goal>testCompile</goal>
                            </goals>
                        </execution>
    </executions>
                    <configuration>
                        <args>
                            <!-- work-around for https://issues.scala-lang.org/browse/SI-8358 -->
                            <arg>-nobootcp</arg>
                        </args>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <version>$spring.boot.version</version>
                    <executions>
                        <execution>
                            <goals>
                                <goal>repackage</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
 <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <version>$maven-assembly-plugin-version</version>
                    <configuration>
                        <finalName>$project.build.finalName</finalName>
                        <appendAssemblyId>false</appendAssemblyId>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>2.22.1</version>
                    <configuration>
                        <skipTests>true</skipTests>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.scalatest</groupId>
                    <artifactId>scalatest-maven-plugin</artifactId>
  <version>2.0.0</version>
                    <configuration>
                        <reportsDirectory>$project.build.directory/surefire-reports</reportsDirectory>
                        <junitxml>.</junitxml>
                    </configuration>
                    <executions>
                        <execution>
                            <id>test</id>
                            <goals>
                                <goal>test</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>com.soebes.maven.plugins</groupId>
                    <artifactId>iterator-maven-plugin</artifactId>
                    <version>0.5.0</version>
                    <executions>
                        <execution>
 <phase>package</phase>
                            <goals>
                                <goal>iterator</goal>
                            </goals>
                            <configuration>
                                <folder>../deployment/config</folder>
                                <pluginExecutors>
                                    <pluginExecutor>
                                        <goal>single</goal>
                                        <plugin>
                                            <groupId>org.apache.maven.plugins</groupId>
                                            <artifactId>maven-assembly-plugin</artifactId>
                                            <version>$maven-assembly-plugin-version</version>
                                        </plugin>
                                        <configuration>
                                            <finalName>$project.artifactId</finalName>
                                     
 </configuration>
                                    </pluginExecutor>
                                </pluginExecutors>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
       

它给出以下错误。

[错误] 无法执行目标 net.alchim31.maven:scala-maven-plugin:4.0.1:compile (default) on project 执行默认目标 net.alchim31.maven:scala-maven-plugin:4.0。 1：编译失败：插件 net.alchim31.maven:scala-maven-plugin:4.0.1 或其依赖项之一无法解析：无法传输工件 org.apache.logging.log4j:log4j-core:jar:2.8 .1 /org/apache/logging/log4j/log4j-core/2.8.1/log4j-core-2.8.1.jar。错误代码 403，请求的项目已被隔离 -> [帮助 1]

内部使用 log4j-core-2.8.1.jar 的依赖项以及如何将 log4j 更新到最新的 2.17.0？

【问题讨论】：

你可能需要检查dependency tree，看看log4j带来了什么依赖

看起来依赖来自ignite-log4j2，但没有发布正确的log4j版本的ignite-log4j2版本。您可以通过在 pom 文件中直接指定对 log4j 的依赖项来覆盖它

【参考方案1】：

尝试使用https://mvnrepository.com/artifact/net.alchim31.maven/scala-maven-plugin/4.5.6

这是最新的，内部使用最新的log4j 2.17