IMP: Debezium 1.8 version - CVE-2022-23307 Vulnerability

[Pavan Manda]

Hi Team,

We are using debezium to connect postgres. Currently, We are NOT able to deploy the debezium to prod as we are receiving CVE-2022-23307 vulnerability related to log4j version 1.2.17 when scanned using twistlock. Please note that we are using Debezium 1.8. Could you please help us in resolving this issue for a smooth deployment.

Regards

Pavan

[Gunnar Morling]

Hi,

Debezium's main deliverables (connector archives) don't contain log4j, so they are not affected by this in any way.

The Debezium container images for Apache Kafka and Kafka Connect do contain log4j 1.2.x, as this is a dependency of Kafka/Connect itself. As a measure of caution, several classes have been removed from log4j JAR shipped in those images, including the Chainsaw classes; see https://issues.redhat.com/browse/DBZ-4568 for the details. This change will be part of the next 1.8 and 1.9 releases. Also see https://debezium.io/blog/2021/12/14/note-on-log4j-security/ for more information on that topic in general.

If you're obtaining Kafka and Connect from another source, you should reach out to the corresponding community.

Hth,

--Gunnar

[Gunnar Morling]

Pavan,

As said before, the Apache Chainsaw classes (which this CVE is about) are removed from the log4j JAR shipping with the Debezium container images, see the Dockerfile here:

    https://github.com/debezium/docker-images/blob/main/kafka/1.8/Dockerfile#L54

This change will be part of the upcoming 1.8.1.Final release (and already is part of 1.9.0.Alpha1). So you either wait for 1.8.1.Final, upgrade to 1.9.0.Alpha1, or derive your own image from the current 1.8.0.Final one, doing the removal of those classes yourself.

--Gunnar

Am Fr., 4. Feb. 2022 um 16:52 Uhr schrieb Pavan Manda <pavan...@gmail.com>:

Hi Gunnar,

Thanks for reverting on this. Yes, log4j vulnerability is form Kafka connect. CVE-2022-23307 is a new vulnerability  introduced few days back. We are seeing this issue inspite of using Debezium 1.8 version. Could you please let us know if any workaround? Below is our wrapper project pom file. Please suggest if any changes needed? (Or) Can we make. any changes to the Dockerfile in the wrapper project to resolve this issue. Pasted our Docker file below.

pom.xml in our wrapper project (Custom one derived from base image):

<properties>
<java.version>11</java.version>
<log4j2.version>2.17.1</log4j2.version>
<log4j.version>2.17.1</log4j.version>
</properties>

<dependencies>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
<version>1.18.22</version>
</dependency>

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-to-slf4j</artifactId>
<version>2.17.1</version>
</dependency>

<!-- https://mvnrepository.com/artifact/org.slf4j/slf4j-api -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.35</version>
</dependency>

<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>connect-api</artifactId>
<version>3.1.0</version>
<exclusions>
<exclusion>
<artifactId>slf4j-api</artifactId>
<groupId>org.slf4j</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.2</version>
<scope>test</scope>
</dependency>
</dependencies>

Dockerfile in our wrapper project (Custom one derived from base image):

FROM <repo>/debezium/connect:1.8.0.Final
ENV DEBEZIUM_DIR=$KAFKA_CONNECT_PLUGINS_DIR/debezium-transformer

RUN mkdir $DEBEZIUM_DIR
COPY target/*.jar $DEBEZIUM_DIR

COPY src/main/resources/certs/* /home/
COPY src/main/resources/kafka_connect.conf /home/
COPY java.config /etc/crypto-policies/back-ends/
#Uncomment below line for Local testing
#COPY src/main/resources/connect-auth.properties /home/

ENV CONNECT_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM=
ENV CONNECT_PRODUCER_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM=
ENV CONNECT_REST_EXTENSION_CLASSES=org.apache.kafka.connect.rest.basic.auth.extension.BasicAuthSecurityRestExtension

ENV JAVA_TOOL_OPTIONS -Djava.security.auth.login.config=/home/kafka_connect.conf
EXPOSE 8080 8778 9779 8083

Regards

~PM

--
You received this message because you are subscribed to the Google Groups "debezium" group.
To unsubscribe from this group and stop receiving emails from it, send an email to debezium+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/debezium/b1b66ec7-b958-493a-b310-28e846b974fcn%40googlegroups.com.

[Gunnar Morling]

Hard to tell; if I had to guess, I'd say it's because whatever checker tool you're using only examines the JAR name itself and not its contents. So it sees the log4j-1.2.27.jar and thus raises this warning, not realizing that this version of the file doesn't contain the Chainsaw classes.

--Gunnar

Am Fr., 11. Feb. 2022 um 16:43 Uhr schrieb Pavan Manda <pavan...@gmail.com>:

Hi @Gunnar Morling

We are still seeing CVE-2022-23307 Vulnerabilities in debezium/connect:1.9.0.Alpha1 version as well.  Could you please let us know what could be the reason.

Regards

~PM

To view this discussion on the web visit https://groups.google.com/d/msgid/debezium/0796bc2d-ad66-4366-be5f-128735078961n%40googlegroups.com.