#1001684 Davmail should use log4j 2.16 rather than 1.2

Package:
davmail
Source:
davmail
Submitter:
Alain Knaff
Date:
2021-12-14 18:03:04 UTC
Severity:
wishlist
Tags:
#1001684#5
Date:
2021-12-14 10:00:02 UTC
From:
To:
Hi,

According to https://github.com/jagornet/dhcp/issues/20 , log4j 1.2 is
vulnerable to CVE-2019-17571, so davmail should use log4j 2.15 or 2.16
instead.

Thanks,
#1001684#10
Date:
2021-12-14 10:51:31 UTC
From:
To:
tag 1001684 moreinfo
thanks

Hi,

According to the debian security tracker[1], this has been fixed in
log4j so davmail uses a fixed version.
https://security-tracker.debian.org/tracker/source-package/apache-log4j1.2

Do you have exploit code that works against davmail or any other clue
that davmail needs fixing?

Thanks,

Alex
#1001684#17
Date:
2021-12-14 11:20:19 UTC
From:
To:
Hi Alexandre,

ok that's good news :-)

Unfortunately not.

I only stumbled upon this when examining our servers for instances
vulnerable to CVE-2021-44228. Forums seem to claim that versions log4j
versions 1 are not safe either (different vulnerabilities), but without
giving any specifics. However, log4j team itself says versions 1.x are
"end of life" and should be avoided. So, it's more a case of "better be
safe than sorry" than any concrete exploit.

Also, since a while already, Java now has its own internal logging
framework (java.util.logging.Logger), so there should be less and less
reason to use potentially unsafe third-party logging libraries (but
switching to java's internal logging might be more difficult to do in
the short run than just upgrading to a newer version).

Regards,
#1001684#22
Date:
2021-12-14 13:14:41 UTC
From:
To:
tag 1001684 -moreinfo +upstream
severity 1001684 wishlist
thanks

I'll try to report this upstream.

Alex
#1001684#33
Date:
2021-12-14 14:57:51 UTC
From:
To:
Qouting https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001684#22
Debian maintainer of Davmail,  Alexandre Rossi:

  > Also, since a while already, Java now has its own internal logging
  > framework (java.util.logging.Logger), so there should be less and
  > less reason to use potentially unsafe third-party logging libraries
  > (but switching to java's internal logging might be more difficult
  > to do in the short run than just upgrading to a newer version).

  I'll try to report this upstream.




And I hope this helps

Groeten
Geert Stappers
#1001684#38
Date:
2021-12-14 16:06:34 UTC
From:
To:
Hi,
[...]

To clarify the log4j1 situation, it appears that it is not vulnerable
unless you use JMSAppender which davmail does not.
(there is also CVE-2019-17571 with SocketAppender which is disabled
but usable in davmail).
To clarify the Debian situation, the Debian package does not use the
embedded jar but the system shared jar.

In the case of davmail, I would say that there is a good chance that
the current provided compiled zip in 6.0.1 is not vulnerable to
CVE-2021-44228 because it does not use JMSAppender.

Alex
#1001684#43
Date:
2021-12-14 18:00:42 UTC
From:
To:


@Alexandre: FYI, your message didn't yet reach Davmail mailinglist subscribers.


Groeten
Geert Stappers