log4j issue with dynamodb-local - looking for release info and a date for what would be 1.17.3 with log4j 2.17

Question

This is regarding the recent (2021-12) issues with log4j (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).

The AWS page on setting up DynamoDB Local at https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.html links to the most current version which shows at 1.17.2 in the README file. There's doesn't seem to be any listing of versions except for the XML file at https://s3.us-west-2.amazonaws.com/dynamodb-local/ and I can't find any resource indicating if there will be a release that bumps the log4j version up to 2.17, which fixes the latest issue found in that module.

Is there a public resource indicating when we can expect a new version or even a public repo for the source code that we can watch for changes? I can't find anything indicating when we might expect a new version or where we can track releases.

Should we stick with 1.17.1 which patches the issue (equivalent to using log4j 2.13.3, if I'm reading correctly) until there's a new version of dynamodb-local that upgrades to log4j 2.17?

Answer

DynamoDB Local recently patched version 1.17.1 which includes custom binary that patches Log4j v2.13.x to remove ```JndiLookup``` class. They have also released 1.17.2 which uses Log4j 2.16.x, which does not include the vulnerability [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228):
> From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed

From the [download](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.html) of version 1.17.2 you can assert that is uses this library:

```ls DynamoDBLocal_lib | grep Log4j-core```.

Furthermore, you can assert that this package does not contain the ```JndiLookup``` class:

```unzip -l DynamoDBLocal_lib/Log4j-core-2.16.jar | grep -i JndiLookup```

DynamoDB Local does not have a public facing repository, however, you can stay up to date with updates on the latest releases [here](https://aws.amazon.com/new/).

log4j issue with dynamodb-local - looking for release info and a date for what would be 1.17.3 with log4j 2.17

Contenuto pertinente