diff options
| author | Zuul <zuul@review.opendev.org> | 2022-02-10 13:16:52 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2022-02-10 13:16:52 +0000 |
| commit | 6b970b4b484ee75b48b8f361cf65354000fb8a7b (patch) | |
| tree | e1af92c655eeba966d1d3149cd333c31d418e60e | |
| parent | 3c8bee583171f6c6a334e039cf16d176f95e46fe (diff) | |
| parent | fe9b3ccb645ebeffd7d84ef4fcc93b90a6661a4a (diff) | |
| download | kolla-6b970b4b484ee75b48b8f361cf65354000fb8a7b.tar.gz kolla-6b970b4b484ee75b48b8f361cf65354000fb8a7b.zip | |
Merge "Mitigate two Log4j vulnerabilities in Apache Storm" into stable/train
| -rw-r--r-- | docker/storm/storm-base/Dockerfile.j2 | 5 | ||||
| -rw-r--r-- | releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/docker/storm/storm-base/Dockerfile.j2 b/docker/storm/storm-base/Dockerfile.j2 index e4a3c6bb1..220835e1d 100644 --- a/docker/storm/storm-base/Dockerfile.j2 +++ b/docker/storm/storm-base/Dockerfile.j2 @@ -10,6 +10,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {% if base_package_type == 'rpm' %} {% set storm_packages = [ 'java-1.8.0-openjdk-headless', + 'zip', ] %} {% elif base_package_type == 'deb' %} @@ -21,6 +22,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {% set storm_packages = [ 'openjdk-' + java_version + '-jre-headless', + 'zip', ] %} {% endif %} @@ -38,6 +40,9 @@ RUN curl -sSL -o /tmp/storm.tgz ${storm_url} \ && tar --strip 1 -xvf /tmp/storm.tgz -C /opt/storm \ && rm -f /tmp/storm.tgz +# Mitigation for CVE-2021-44228 and CVE-2021-45046: remove the JndiLookup class +# from the classpath +RUN zip -q -d /opt/storm/lib/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class {% endblock %} {% block storm_python_version %} diff --git a/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml b/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml new file mode 100644 index 000000000..5126662ad --- /dev/null +++ b/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml @@ -0,0 +1,5 @@ +--- +security: + - | + Adds mitigation for Apache Log4j 2 Remote Code Execution (RCE) + vulnerabilities CVE-2021-44228 and CVE-2021-45046 to Apache Storm. |