Is xenforo vulnerable to log4j?
- Thread starter James T
- Start date
Masetrix
Well-known member
After such important security updates, I always restart the server in order to have the main memory and caches really up to date
sbj
Well-known member
Due to the new information, I also updated my elasticsearch to the newest branch just to be sure.
While I did that, -of course never change a running system-, my elasticsearch service failed to restart at all.
Of course panic mode was enabled and I had to google my ass off why it wouldn't start. It came down to that somehow the newest branch compared to my old branch (7.6 vs 7.16) had some jvm.options related to java which were no longer supported/included anymore. So commenting out GC configuration was the solution...
Writing this in case anyone else encounters the same problem.
While I did that, -of course never change a running system-, my elasticsearch service failed to restart at all.
Of course panic mode was enabled and I had to google my ass off why it wouldn't start. It came down to that somehow the newest branch compared to my old branch (7.6 vs 7.16) had some jvm.options related to java which were no longer supported/included anymore. So commenting out GC configuration was the solution...
Code:
## GC configuration
#-XX:+UseConcMarkSweepGC
#-XX:CMSInitiatingOccupancyFraction=75
#-XX:+UseCMSInitiatingOccupancyOnlyWriting this in case anyone else encounters the same problem.
Last edited:
I see a few people have noted today that the tweak toNope
Security Notice: Apache Log4j2 CVE-2021-44228 - Redis
Redis security notice for Apache Log4j2 CVE-2021-44228.redis.com
@all You should install log4j 2.16 as soon as possible, log4j 2.15.0 is still vulnerable!
/etc/elasticsearch/jvm.options isn't now considered adequate.I guess this means that the XenForo PSA here now needs to be updated, so that those who thought we had done enough will look at it again?
(I've just used the
zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class approach from the latest NVD update here, with the path tweaked of course.)
gerryvz
Well-known member
You need to add the elastic.co repository to your operating system. Then, every time you run a
Code:
yum update
Code:
apt updateThe URL that I added is:
Code:
https://artifacts.elastic.co/packages/7.x/apt stable InReleaseIf there is an update available (perhaps once a month), then I do a
Code:
apt upgradeThen I restart elasticsearch with the
Code:
/etc/init.d/elasticsearch restart
motowebmaster
Well-known member
Yes, apologies if I appeared negative.
I run ES on a separate Debian instance (connected via a private network). There are times I reboot after an update, but for me restarting ES will temporarily break search on my XF site like a reboot would. Either way after a few moments the XF admincp will reflect the updated version number when ES is running after the restart.
My adoption of XF Enhanced Search is a bit of a recent experience. Adopted a few of the recommendations here, but followed Elasticsearch's server config/optimization guide for the majority of the steps. I think it includes a section on restart options/alternatives.
Robru
Well-known member
Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31
Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary...
discuss.elastic.co
This covers it nicely. Upgrade to 7.16.1 and it looks like you are fully covered. They have removed the dodgy component and added the previously mentioned line to the config by default.Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31
Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary...
Bit of a stressful one...
For anyone else. Elasticsearch does have pretty good install instructions.
gerryvz
Well-known member
Elasticsearch just released 7.16.2
Includes a log4j upgrade.
Release notes here:
Includes a log4j upgrade.
Release notes here:
Similar threads
- Solved
- Question
