This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/logging-site.git
The following commit(s) were added to refs/heads/main by this push:
new 2cd27ed3 Correct historical context of deserialization FAQ (#43)
2cd27ed3 is described below
commit 2cd27ed3f3f88ff94d8269f89b7239077ac92aff
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Thu Aug 27 08:49:37 2026 +0200
Correct historical context of deserialization FAQ (#43)
The security FAQ claimed that the `SocketServer` receiver was never
reintroduced into the Log4j 2 production codebase. This is inaccurate:
`log4j-core` contained TCP and UDP socket servers inherited from Log4j 1 up to
and including the 2.8.x releases. As any endpoint consuming serialized data,
they were dangerous to use and resulted in CVE-2017-5645. The vulnerability was
patched in 2.8.2 by introducing `FilteredObjectInputStream` as a Java 7
equivalent of the `ObjectInputFilter` API [...]
This change corrects the section and expands it with this history,
cross-linking the CVE-2017-5645 entry on the security page.
Assisted-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GeV6uBXR77uZVnPAUUjF6n
---
src/site/antora/modules/ROOT/pages/security/faq.adoc | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/site/antora/modules/ROOT/pages/security/faq.adoc
b/src/site/antora/modules/ROOT/pages/security/faq.adoc
index 172e0268..547d4b46 100644
--- a/src/site/antora/modules/ROOT/pages/security/faq.adoc
+++ b/src/site/antora/modules/ROOT/pages/security/faq.adoc
@@ -208,9 +208,14 @@ Log4j provides **no guarantee** that deserializing a
stream containing its class
Log4j 1 shipped a `SocketServer` and a `SocketAppender` that exchanged log
events over the network using Java serialization.
-In Log4j 2:
+Log4j 2 inherited this functionality: up to and including the 2.8.x releases,
`log4j-core` contained TCP and UDP socket servers (`TcpSocketServer` and
`UdpSocketServer`) that received serialized log events from other applications.
+As with any endpoint that consumes serialized data from the network, these
servers were dangerous to operate and resulted in
xref:security.adoc#CVE-2017-5645[CVE-2017-5645].
-* The `SocketServer` receiver was never reintroduced into the production
codebase.
+The vulnerability was patched in version `2.8.2` by introducing
`FilteredObjectInputStream`, an allowlist-based equivalent for Java 7 of the
`ObjectInputFilter` API introduced in Java 9.
+Since this fix could not cover all cases, the socket servers were removed
entirely in the next release, `2.9.0`.
+Since then:
+
+* No socket server has ever been reintroduced into the production codebase.
* `SerializedLayout`, originally provided for Log4j 1 compatibility, has been
**deprecated since version 2.9** and should not be used.
See the
{site-url}/log4j/2.x/manual/layouts.html#SerializedLayout[SerializedLayout
documentation] for details.
* Several Log4j 2 classes, most notably `Logger`, `Message` and `LogEvent`,
remain `Serializable` for backward compatibility.
