View Issue Details

IDProjectCategoryView StatusLast Update
0000388opensim-SCBugpublic2021-12-15 05:20
Reporteronefang Assigned Toonefang  
PriorityurgentSeveritymajorReproducibilityhave not tried
Status resolvedResolutionfixed 
Product Version0.9.1.1 
Target Version0.9.1.1Fixed in Version0.9.1.1 
Summary0000388: Update log4net
DescriptionSeems it is susceptible to the log4shell exploit.

https://github.com/advisories/GHSA-2cwj-8chv-9pp9

Naturally OpenSim includes it as one of the binary blobs.

"Log4Net 2.0.8.0 in OpenSim 0.9.2.0 release and 0.9.21. Dev master"

OpenSim 0.9.1.1 uses 2.0.8.0. Devuan Beowulf has 1.2.10+dfsg-7, but not actually installed on SuperBitch.
Additional InformationOn the other hand "This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users." and we don't do that.
TagsNo tags attached.

Activities

onefang

onefang

2021-12-14 11:01

administrator   ~0000526

https://www.debian.org/lts/security/2020/dla-2211.en.html It was fixed in Jessie.

So now I just gotta see if OpenSim can live with that version instead of it's binary blob.
onefang

onefang

2021-12-14 11:14

administrator   ~0000527

Installing Debian's liblog4net1.2-cli and removing the binary blob from OpenSim seems to have worked.
onefang

onefang

2021-12-14 17:04

administrator   ~0000528

Building with the newer log4net is a problem. It's still finding the old one somewhere and bitching about it.

Also the docs for how to find out what version is being used are wrong for this new version. And apt-get source can't find it's source code.
onefang

onefang

2021-12-15 05:20

administrator   ~0000530

It's a complete clusterfuck.

Oddly enough this particular bug was fixed long ago in log4net, in version 2.0.10.0. OpenSim has a binary blob of 2.0.8.0.

Devuan Linux uses Debian's version of log4net, and is on 2.0.10.0. Installing that worked fine, but then building OpenSim fails, coz it's still picking up 2.0.8.0 from one of the other binary blobs in OpenSim.

Soooo, I added a "print the actual version of log4net" line to OpenSim.

Which doesn't actually fucking work in any log4net beyond 2.0.9.0. Coz, they decided they didn't really need it, even though the source code for getting the version is in there. That source code isn't actually built.

No problem, I'll just build it myself. Only you can only build in on Windows.

At this point I just tested the official release of 2.0.13.0, it works, said fuck it and just went with it. Even though it still wont print the version number.

Also, any version of log4net beyond 2.0.9.0 has the version 2.0.9.0 hard coded as it's version number, not that it makes any difference, it wont report it anyway.

Sooo, what do you expect from something that executes log lines? A complete clusterfuck. And people wonder why I'm rewriting OpenSim entirely in C + Lua.

Issue History

Date Modified Username Field Change
2021-12-14 10:48 onefang New Issue
2021-12-14 10:48 onefang Status new => assigned
2021-12-14 10:48 onefang Assigned To => onefang
2021-12-14 11:01 onefang Note Added: 0000526
2021-12-14 11:14 onefang Note Added: 0000527
2021-12-14 11:59 onefang Description Updated
2021-12-14 17:04 onefang Note Added: 0000528
2021-12-15 05:20 onefang Status assigned => resolved
2021-12-15 05:20 onefang Resolution open => fixed
2021-12-15 05:20 onefang Fixed in Version => 0.9.1.1
2021-12-15 05:20 onefang Note Added: 0000530