tree d1e1c4f4238f920450d9cfd4f7f7a595190b1bd1
parent 0f31503a303fe7f42ab97fab88075aa8e141c17c
author Arvind Shyamsundar <arvindsh@apache.org> 1641317128 -0800
committer GitHub <noreply@github.com> 1641317128 -0800
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJh1IMICRBK7hj4Ov3rIwAASakIAA/JJaqhD3NzN6iVnO6TMUil
 FuRoF6b0C1sD42SBCfeQyeuw4g6gnhEn17cn0LItUKyK1dX3UcrLQ/2jd5RbobZh
 o8GiU0m2tjsHQ6DMyilLMtah9FdpN9I+DqwrTgT4p2hcefuTsfvOtyRAdZKgV65K
 FTXYnqY2c3ZBso4WC8kDITTEB+42w6CyLiP2K3Edx/7IvHbLuZGwK87XTo+mA2ce
 Bp591wVGk/BPgM2KXuYk6agiuovDSQiXTDALYTJvw1jMTqoLF7Oda4xmL3whDxPv
 P3R0N36neiZnDtKRQcz1d/du/El3FpSmc48tF9ty53VOIik1IGT/oE02f4cs33c=
 =iQct
 -----END PGP SIGNATURE-----
 

Mitigate Log4Shell issues in ELK stack (#425)

Fixes #418.

Muchos can be used to deploy an optional `elkserver` role wherein
OSS versions of the ELK stack are deployed (see #338).

Elasticsearch and Logstash are among the external packages deployed
when the `elkserver` role is optionally assigned to hosts in muchos.props.
Both those packages use an older version of log4j2 which is vulnerable
to the following known issues:

https://nvd.nist.gov/vuln/detail/CVE-2021-44228
&
https://nvd.nist.gov/vuln/detail/CVE-2021-45046

ElasticSearch and Logstash and have addressed these
vulnerabilities in their 7.16.2 releases. However, due to licensing
issues the last OSS ELK stack version is 7.10.2, which requires the
removal of the JNDI class for mitigation.

Hence, we mitigate the known vulnerabilities by deleting the JNDI class
from the older log4j2-core JAR deployed by those external components.