View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|0000388||opensim-SC||Bug||public||2021-12-14 10:48||2021-12-15 05:20|
|Priority||urgent||Severity||major||Reproducibility||have not tried|
|Target Version||0.9.1.1||Fixed in Version||0.9.1.1|
|Summary||0000388: Update log4net|
|Description||Seems it is susceptible to the log4shell exploit.|
Naturally OpenSim includes it as one of the binary blobs.
"Log4Net 22.214.171.124 in OpenSim 0.9.2.0 release and 0.9.21. Dev master"
OpenSim 0.9.1.1 uses 126.96.36.199. Devuan Beowulf has 1.2.10+dfsg-7, but not actually installed on SuperBitch.
|Additional Information||On the other hand "This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users." and we don't do that.|
|Tags||No tags attached.|
https://www.debian.org/lts/security/2020/dla-2211.en.html It was fixed in Jessie.
So now I just gotta see if OpenSim can live with that version instead of it's binary blob.
|Installing Debian's liblog4net1.2-cli and removing the binary blob from OpenSim seems to have worked.|
Building with the newer log4net is a problem. It's still finding the old one somewhere and bitching about it.
Also the docs for how to find out what version is being used are wrong for this new version. And apt-get source can't find it's source code.
It's a complete clusterfuck.
Oddly enough this particular bug was fixed long ago in log4net, in version 188.8.131.52. OpenSim has a binary blob of 184.108.40.206.
Devuan Linux uses Debian's version of log4net, and is on 220.127.116.11. Installing that worked fine, but then building OpenSim fails, coz it's still picking up 18.104.22.168 from one of the other binary blobs in OpenSim.
Soooo, I added a "print the actual version of log4net" line to OpenSim.
Which doesn't actually fucking work in any log4net beyond 22.214.171.124. Coz, they decided they didn't really need it, even though the source code for getting the version is in there. That source code isn't actually built.
No problem, I'll just build it myself. Only you can only build in on Windows.
At this point I just tested the official release of 126.96.36.199, it works, said fuck it and just went with it. Even though it still wont print the version number.
Also, any version of log4net beyond 188.8.131.52 has the version 184.108.40.206 hard coded as it's version number, not that it makes any difference, it wont report it anyway.
Sooo, what do you expect from something that executes log lines? A complete clusterfuck. And people wonder why I'm rewriting OpenSim entirely in C + Lua.
|2021-12-14 10:48||onefang||New Issue|
|2021-12-14 10:48||onefang||Status||new => assigned|
|2021-12-14 10:48||onefang||Assigned To||=> onefang|
|2021-12-14 11:01||onefang||Note Added: 0000526|
|2021-12-14 11:14||onefang||Note Added: 0000527|
|2021-12-14 11:59||onefang||Description Updated|
|2021-12-14 17:04||onefang||Note Added: 0000528|
|2021-12-15 05:20||onefang||Status||assigned => resolved|
|2021-12-15 05:20||onefang||Resolution||open => fixed|
|2021-12-15 05:20||onefang||Fixed in Version||=> 0.9.1.1|
|2021-12-15 05:20||onefang||Note Added: 0000530|