MEDIUM

GHSA-445c-vh5m-36rj

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Quick fix

GHSA-445c-vh5m-36rj — org.apache.logging.log4j:log4j-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>2.25.4</version> for org.apache.logging.log4j:log4j-core

Details

Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

* The `newLineEscape` attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The `useTlsMessageFormat` attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the `SyslogAppender` are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.logging.log4j:log4j-core

Introduced in: 2.21.0Fixed in: 2.25.4

Fix# pom.xml: bump <version>2.25.4</version> for org.apache.logging.log4j:log4j-core

Maven/org.apache.logging.log4j:log4j-core

Introduced in: 3.0.0-beta1

No fixed version published yet for org.apache.logging.log4j:log4j-core (maven). Pin to a known-safe version or switch to an alternative.

Details

Are you affected?

Affected packages

References