Log4j Disable Literal Pattern Converter

Open cliveverghese opened this issue 3 years ago • 0 comments

Although -DformatMsgNoLookups=true prevents lookups directly in the message, Format Lookups are possible when reading a property from the ThreadContext/MDC in the pattern for the message. On certain scenarios, this can cause a StackOverflow through recursive lookups as described on CVE-2021-45105.

This patch disables lookups in Message Pattern by patching LiteralPatternConverter.

The patch for LiteralPatternConverter is not enabled by default and can be enabled using the following parameters

patcherClassName=com.amazon.corretto.hotpatch.patch.impl.set.Log4j2PatchSetWithDisableLookups

Dec 23 '21 20:12 cliveverghese