Log4J CVE Mitigation for Neo4j

[michael_hunger]

Hi Everyone,

We are writing to alert you of a potential vulnerability issue - CVE-2021-44228

lunasec.io – 9 Dec 21

Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging package...

Given how ubiquitous this library is, the impact of this vulnerability is quite severe. Learn how to patch it, why it's bad, and more in this post.

The issue impacts Neo4j version 4.2+.

Versions 4.0 and 4.1 use slf4j-log4j12 and are not impacted.

Version 4.2 introduces using log4j2

github.com

neo4j/neo4j/blob/4.2/pom.xml#L140

    
      

          
    <mockito.version>3.5.13</mockito.version>
          
    <opencypher.version>1.0.0-M15</opencypher.version>
          
    <caffeine.version>2.8.5</caffeine.version>
          
    <required.maven.version>3.5.4</required.maven.version>
          
    <jackson.version>2.11.3</jackson.version>
          
	<amazon-sdk.version>1.11.1022</amazon-sdk.version>
          
    <guava.version>29.0-jre</guava.version>
          
    <awaitility.version>4.0.3</awaitility.version>
          
    <!--    Be careful when updating Log4j version. We have workarounds for problems with shading/plugin handling
          
            in Log4jPluginLoadingWorkaround that must be verified to still work after bumping the version. -->
          
    <log4j.version>2.14.0</log4j.version>
          
    <slf4j.version>1.7.30</slf4j.version>
          
    <neo4j-java-driver.version>4.2.8</neo4j-java-driver.version>
          
    <skip-scalastyle>false</skip-scalastyle>
          
  </properties>
          

          
  <modules>
          
    <module>annotations</module>
          
    <module>build-resources</module>
          
    <module>community</module>
          
    <module>packaging</module>
      
    
  

We are working on a fix in 4.2 and up (Neo4j versions 4.3 and 4.4),

Meanwhile please use the configuration setting in your $PATH_TO_NEO4J/conf/neo4j.conf or /etc/neo4j/neo4j.conf. (That is also the case for Neo4j Desktop)

dbms.jvm.additional=-Dlog4j2.formatMsgNoLookups=true

dbms.jvm.additional=-Dlog4j2.disable.jmx=true

which mitigates the problem.

A restart will be required for the configuration property change to be read and applied.

In Neo4j Sandbox the issue has already been addressed for new sandboxes.

In Neo4j AuraDB the issue has also been mitigated.

The docker images have also been updated with a config setting disabling jmx.

Cheers, Michael