log4j修复JBOSS KAFKA
log4j 1.x已于2015年达到生命的终结，不再得到支持。未检查2015年8月对Log4J 1.X的漏洞未经检查，也不会固定。用户应升级到log4j 2以获取安全修复。
Kafka是应用程序用于在微服务之间进行通信的软件。 JBOSS服务器中的Kafka使用log4j 1.x。我们需要在这里使用2.x log4j。
已安装脆弱软件：Apache Log4J 1.2.17（/apps/server/standalone/kafka/kafka/kafka_2.11-0.10.1.1.1.1.0/libs/log4j-1.2.17.jar）
log4j 1.2.17。需要补充这一点。
JBOSS版本是JBOSS-AEP-6.4的
方式是什么？
Log4j 1.x has reached End of Life in 2015 and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed. Users should upgrade to Log4j 2 to obtain security fixes.
Kafka is a software used by the application to communicate between microservices. Kafka in Jboss servers is using log4j 1.x. We need to be able to use 2.x log4j here.
Vulnerable software installed: Apache Log4j 1.2.17 (/apps/server/standalone/kafka/kafka_2.11-0.10.1.0/libs/log4j-1.2.17.jar)
All new Kafka version also uses Log4j 1.2.17. Need to remediate this.
JBoss version is jboss-eap-6.4
What is the way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
log4j2未计划使用Kafka发布，直到Kafka 4.0 -
在此之前，您可以尝试直接修改log4j jar jars以删除弱点类，例如JMSAppender，或用Reload4J替换，仅在最近的consits中可用（Kafka 3.1.1＆amp; 3.2） - https://github.com/apache/kafkace/kafka/pull/11743
当您的jboss使用kafka时，请看到kafka现在几年了，如果不升级JBOSS本身，可能无法直接升级
Log4j2 is not scheduled to be released with Kafka until Kafka 4.0 - KAFKA-9366
Until then, you can try to directly modify the log4j jars yourself to remove vulnerable classes, such as JMSAppender, or replace with reload4j, as only available in recent commits (Kafka 3.1.1 & 3.2) - https://github.com/apache/kafka/pull/11743
Seeing as your Jboss is using a version of Kafka several years old now, it might not be possible to upgrade directly without upgrading Jboss itself