Until cPanel releases updates to the relevant RPM packages, I needed a temporary fix.
Using the suggestion (from here:
NVD - CVE-2021-45046) to remove the JndiLookup class from log4j, I think we may be able to remove the vulnerability by issueing this command as root (otherwise prefix both lines with "sudo "):
Code:
find / -name 'log4j-core*.jar' -type f | xargs -I % sh -c 'echo "%"; cp -a "%" "%.orig"; unzip -t "%" | grep JndiLookup.class; zip -q -d "%" org/apache/logging/log4j/core/lookup/JndiLookup.class; chown cpanelsolr. "%"; unzip -t "%" | grep -q JndiLookup.class || echo "JndiLookup.class succesfully removed"';
service cpanel-dovecot-solr restart
This does the following:
- Finds all files matching 'log4j-core*.jar' and for each file...
- prints the file name
- make a spare copy of the file by adding ".orig"
- checks via unzip if it contains a file JndiLookup.class
- use zip to remove that JndiLookup.class file from the jar file.
- change ownership back to cpanelsolr (because the zip command changes it to root)
- check again with unzip if the JndiLookup.class is now really gone.
- restart the cpanel-dovecot-solr service
If you're getting this, you don't have cpanel-dovecot-solr installed:
Code:
Redirecting to /bin/systemctl restart cpanel-dovecot-solr.service
Failed to restart cpanel-dovecot-solr.service: Unit not found.
If you're getting this (ignore the lines with /proc/ in it), you've temporarily fixed the issue for cpanel-dovecot-solr (until we get an official RPM update from cPanel):
Code:
find: ‘/proc/12531’: No such file or directory
/home/cpanelsolr/server/lib/ext/log4j-core-2.13.2.jar
testing: org/apache/logging/log4j/core/lookup/JndiLookup.class OK
JndiLookup.class succesfully removed
/home/cpanelsolr/contrib/prometheus-exporter/lib/log4j-core-2.13.2.jar
testing: org/apache/logging/log4j/core/lookup/JndiLookup.class OK
JndiLookup.class succesfully removed
Redirecting to /bin/systemctl restart cpanel-dovecot-solr.service
Beware: if it finds log4j-core-*.jar files in locations other than /home/cpanelsolr/ then you may have to restart other services as well. The file location might put you on the right track to find which services.
edit: I see that updated RPMs are available now, BUT, I still see this file containing JndiLookup.class: /home/cpanelsolr/contrib/prometheus-exporter/lib/log4j-core-2.13.2.jar. Not sure if that matters or not, but the suggested fix above handles that as well.
www.huntress.com
