Hallo Justin,
Thank You for the clarification.
Of course I understand that there is no immediate vulnerability risk.
Nevertheless the widespread use of the component and the sensitivity of the
security community on this issue must not to be underestimated.
Therefore a timely release of version 5.17 with updated log4j would help to
reduce some uncertainties.
Best Regards
Ralf
Von: Justin Bertram <[email protected]<mailto:[email protected]>>
Gesendet: Donnerstag, 13. Januar 2022 21:59
An: [email protected]<mailto:[email protected]>
Cc: [email protected]<mailto:[email protected]>; Riechmann, Thomas
<[email protected]<mailto:[email protected]>>; Höck, Ulrich
<[email protected]<mailto:[email protected]>>
Betreff: Re: Call for action - vulnerability (CVE-2021-44228,CVE-2019-17571) -
Active MQ classic
Caution! External email. Do not open attachments or click links, unless this
email comes from a known sender and you know the content is safe.
The official statement "the latest versions (i.e. 5.15.15 and 5.16.3) use Log4j
1.2.17 which is not impacted by CVE-2021-44228" is not accepted, as Log4j 1.2.17 has
not been maintained since August 2015.
The "official statement" [1] that you reference is only dealing with
CVE-2021-44228. It's not a general statement about all the security vulnerabilities in
Log4j 1.2.17. It remains a fact that Log4j 1.2.17 is not impacted by CVE-2021-44228.
Here an existing security vulnerability, (CVE-2019-17571) is not fixed with the note
"Users are urged to upgrade to Log4j 2".
Regarding CVE-2019-17571 you can read more on this Jira [2]. In short, as noted by
Jean-Baptiste Onofré, "ActiveMQ is not affected as it doesn't use the SocketServer.
However, I think it makes sense to update/support log4j2..." AMQ-7426 [3] was later
created to track the work to upgrade to Log4j 2.
This situation will not be accepted by a number of large customers, which
demand a timely exchange of this component to the officially released new Log4j
version 2.
Since you've sent this email to the public Apache ActiveMQ mailing lists you're dealing with "community
support" as described on the ActiveMQ website [4]. As noted, this support is provided on a volunteer basis.
Furthermore, in the spirit of open-source, all community members are encouraged (although certainly not required) to
get involved. As noted in a recent position paper [5] from the Apache Software Foundation, "Community is defined
by those who show up and do the work." I would strongly encourage your organization, as an "intensive user of
the Apache technology," to avail itself of *all* the benefits of open source. With your help to "do the
work" this issue could potentially have been resolved long ago.
Therefore we ask you kindly to name and communicate an official release date
for ActiveMQ 5.17.0 (including the Log4j version 2).
Given the volunteer nature of community support and how open-source works at Apache I'm
not sure "an official release date" can be provided, at least not like you'd
expect from a commercial software vendor. As noted on the users mailing list as well as
the Log4j 2 upgrade PR [6] (linked from the aforementioned statement about CVE-2021-44228
[1]), the current plan is to put a release up for vote at the end of January. All
community members can vote on the release for 3 days, and if the vote passes then the
release should be done in early February.
I hope that helps!
Justin
[1] https://activemq.apache.org/news/cve-2021-44228
[2] https://issues.apache.org/jira/browse/AMQ-7370
[3] https://issues.apache.org/jira/browse/AMQ-7426
[4] https://activemq.apache.org/support
[5] https://cwiki.apache.org/confluence/display/COMDEV/Position+Paper
[6] https://github.com/apache/activemq/pull/662
On Thu, Jan 13, 2022 at 2:09 PM Knöringer, Ralf
<[email protected]<mailto:[email protected]>>
wrote:
To whom it may concern,
as a intensive user of the Apache technology in our enterprise architecture and
product portfolio I may draw your attention to a critical issue.
Based on the known vulnerability CVE-2021-44228 in the Log4j Version 2 many of
our large enterprise customers (e.g. Volkswagen Financial Services) are
becoming very sensitive for the risk of using software elements not under
maintenance.
Unfortunately we have this situation with the message broker ActiveMQ "Classic"
(the latest versions 5.15.15 and 5.16.3) as there is an embedded use of the Log4j version
1.2.17.
The official statement "the latest versions (i.e. 5.15.15 and 5.16.3) use Log4j
1.2.17 which is not impacted by CVE-2021-44228" is not accepted, as Log4j 1.2.17 has
not been maintained since August 2015.
(Here an existing security vulnerability, (CVE-2019-17571) is not fixed with the note
"Users are urged to upgrade to Log4j 2".)
This situation will not be accepted by a number of large customers, which
demand a timely exchange of this component to the officially released new Log4j
version 2.
Therefore we ask you kindly to name and communicate an official release date
for ActiveMQ 5.17.0 (including the Log4j version 2).
A timely answer is really appreciated as we think this could mitigate negative
responses and create a positive feedback from the market.
Best regards
Ralf Knöringer
Senior Manager
Big Data & Cybersecurity - IAM
M: +49 172 5229705
Otto-Hahn-Ring 6, 81739 Munich - Germany
atos.net<http://atos.net><https://atos.net/>
Atos Information Technology GmbH; Geschäftsführung: Udo Littke, Boris Hecker;
Vorsitzender des Aufsichtsrats: N.N.; Sitz der Gesellschaft: München;
Registergericht: Amtsgericht München, HRB 235509
Atos Information Technology GmbH; Managing Directors: Udo Littke, Boris Hecker;
Chairman of the Supervisory Board: N.N.; Registered office: Munich; Commercial
register of the local court of Munich, HRB 235509
Important notice: This e-mail and any attachment thereof contain corporate
proprietary information. If you have received it by mistake, please notify us
immediately by reply e-mail and delete this e-mail and its attachments from
your system. Thank you.
