8 ms·
> I can still just inject stuff like "${env:DATABASE_PASSWORD:-xxx} In 2.16.0 message lookups have been completely removed: https://github.com/apache/logging-l
by jabiko 5y ago
> I can still just inject stuff like "${env:DATABASE_PASSWORD:-xxx}
In 2.16.0 message lookups have been completely removed: https://github.com/apache/logging-log4j2/pull/623 https://github.com/apache/logging-log4j2/pull/623
Lookups now only work in configured patterns. Thats IMHO the way it should have been in the first place.
- terom 5y agoThey still work in the CVE-2021-45046 context lookup vector.
- Macha 5y agoMy understanding is this is true if you've simply disabled them with the config flag to 2.15, but is not true in 2.16?
- terom 5y agoThat applies to the <2.15 mitigation for disabling message lookups. That mitigation for message lookups does not affect context lookups. Nor does the 2.15 fix for disabling, nor the 2.16 fix for removing message lookups. But 2.16 disables JNDI lookups entirely, so that they cannot be triggered via any lookups, including context lookups. But context lookups can still trigger other non-JNDI lookups.
- dekmetzi 5y agoAgree. Too easy for folks to create vulnerabilities by evaluating those arguments as if they were trusted.