We are using jetty9.4.43 in our application.
Logging modules not being used by default.
Can any one confirm whether jetty9.4.43 has any impact over CVE-2021-44228?
Update: Dec 18, 2021
There is a new Log4j CVE just issued.
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
Minimum recommended Log4j version is now 2.17.0.
Update: Dec 13, 2021
There is a new Log4J CVE issued.
https://access.redhat.com/security/cve/cve-2021-45046
Minimum recommended Log4j version is now 2.16.0
Original Text
Also covered at https://webtide.com/jetty-log4j2-exploit-cve-2021-44228/
Jetty has no direct dependency on log4j.
Jetty 9.x uses it's own logging framework StdErrLog, and has optional support for slf4j.
You, as a consumer of Jetty, can choose to use slf4j and then optionally take the next step and use log4j within that slf4j configuration.
So, while it's possible to use log4j 1.x or 2.x on Jetty 9.x, it's a decision that users choose to make, and it's up to the users to decide what they want to do. (Eg: upgrade to log4j 2.16.0 to satisfy both recent CVEs, or switch to a different logging framework like logback)
Waiting for a new release of Jetty is not necessary to address this CVE.
Also note that the log4j2 CVE does not impact users on Java 11.0.2 or newer, as the internal JVM property com.sun.jndi.ldap.object.trustURLCodebase is set to false by default starting with Java 11.0.2, which disables JNDI loading of classes from arbitrary URL code bases. (Users on Java 8 have more work than users on Java 11.0.2 or newer)
Eclipse Jetty Security Reports
All verified security reports for Eclipse Jetty can be found at ...
https://www.eclipse.org/jetty/security_reports.php
Github tracked and published advisories can be found at ...
https://github.com/eclipse/jetty.project/security/advisories?state=published
Related
I am trying to install and run ESB and CEP both on the same machine. I have tried to set port offset to 1, to prevent port conflict, but still after running ESB, I am not able to run CEP. The error log in cmd is as bellow:
`C:\Program Files\yajsw-stable-11.03_cep\bat>call setenv.bat
"java" -Xmx30m -Djna_tmpdir="C:\Program Files\yajsw-stable-11.03_cep\bat\/../tmp
" -jar "C:\Program Files\yajsw-stable-11.03_cep\bat\/../wrapper.jar" -t "C:\Program Files\yajsw-stable-11.03_cep\bat\/../conf/wrapper.conf"
YAJSW: yajsw-stable-11.03
OS : Windows 7/6.1/amd64
JVM : Oracle Corporation/1.7.0_75
Dec 20, 2015 11:44:31 AM org.apache.commons.vfs2.VfsLog info
INFO: Using "C:\Users\K5563~1.KHA\AppData\Local\Temp\vfs_cache" as temporary files store.
platform null
************* STARTING "WSO2CARBON_cep" ***********************
Service "WSO2CARBON_cep" NOT started
Press any key to continue . . .`
First : where and how can I find a proper log to figure out what is the problem? As you know, there is nothing in : repository\logs until the program starts to run.
Second : if you have any idea about the probable cause, please let me know.
Additional info : I am using jdk 1.7.0_75, esb 4.9.0, cep 4.0.0, yajsw 11.03, and there was a success message after installation of both esb and cep. I gave them different service names while installing as a windows service, to prevent conflict. Also, I am able to see both of them in windows services list.
Thanks for reading.
To start two carbon servers as windows services please follow the blog post below[1] to overcome this issue. The blog explains how two services can be run as windows services.
Some important areas to consider when setting up two nodes as windows services are :
1.create two folders as 'esb_service' and 'cep_service' and copy the relevant packs into each foldr
2.As shown on[1] please update the esb_home and cep_home on the relevant places within the wrapper.conf replacing the carbon_home which is the default value
3.Make sure that the port offset of one of the two nodes is incremented by one to avoid port conflict.
4.start the two yajsw-stable-11.03 with installService.bat and startService.bat to get the services running
Note: I have tried this scenario using yajsw-stable-11.03 version.
[1]http://blog.lasindu.com/2015/05/how-to-start-two-or-more-wso2-servers.html
I have install Virtual Machine Manager on windows server 2012 R2 . it installed sucessfuly but the SCVMM service can't be started please check the following log for and the error
when i try to start SCVMM service its endup with the following error
" The System Center Virtual Machine Manager Service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.
"
Log Name: Application
Source: SCVMMService
Date: 11/4/2014 7:58:55 AM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: HC**********
Description:
Service cannot be started. System.Reflection.ReflectionTypeLoadException: Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information.
at System.Reflection.RuntimeModule.GetTypes(RuntimeModule module)
at System.Reflection.RuntimeModule.GetTypes()
at System.Reflection.Assembly.GetTypes()
at Microsoft.VirtualManager.Remoting.IndigoSerializableObject.BuildKnownAssemblyTypes(Assembly assembly)
at Microsoft.VirtualManager.Remoting.IndigoSerializableObject.InitializeKnownTypesCache(List`1 assembliesToExamine)
at Microsoft.VirtualManager.Engine.Remoting.IndigoServiceHost.InitializeKnownTypesCache()
at Microsoft.VirtualManager.Engine.VirtualManagerService.TimeStartupMethod(String description, TimedStartupMethod methodToTime)
at Microsoft.VirtualManager.Engine.VirtualManagerService.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="SCVMMService" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-11-04T07:58:55.000000000Z" />
<EventRecordID>10656</EventRecordID>
<Channel>Application</Channel>
<Computer>HC-S*********** </Computer>
<Security />
</System>
<EventData>
<Data>Service cannot be started. System.Reflection.ReflectionTypeLoadException: Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information.
at System.Reflection.RuntimeModule.GetTypes(RuntimeModule module)
at System.Reflection.RuntimeModule.GetTypes()
at System.Reflection.Assembly.GetTypes()
at Microsoft.VirtualManager.Remoting.IndigoSerializableObject.BuildKnownAssemblyTypes(Assembly assembly)
at Microsoft.VirtualManager.Remoting.IndigoSerializableObject.InitializeKnownTypesCache(List`1 assembliesToExamine)
at Microsoft.VirtualManager.Engine.Remoting.IndigoServiceHost.InitializeKnownTypesCache()
at Microsoft.VirtualManager.Engine.VirtualManagerService.TimeStartupMethod(String description, TimedStartupMethod methodToTime)
at Microsoft.VirtualManager.Engine.VirtualManagerService.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)</Data>
</EventData>
</Event>
Thanks for posting here.
To resolve this issue, review the AD group membership for any circular references and remove them. If the circular reference is not obvious, the script below can list the nested members of a particular group.
NOTE Use Active Directory Users and Computers to determine the top most group of the group causing issues.
dsquery group -name "Group_VMMSSU" | dsget group -members -expand
I hope you have followed these steps before installing SCVMM
High Level Deployment Process:
In AD, create the following accounts and groups, according to your naming convention:
•DOMAIN\scvmmsvc SCVMM Service Account account
•DOMAIN\scvmmadmin SCVMM RunAs account for managing hosts
•DOMAIN\sqlsvc SQL service account
•DOMAIN\SCVMMAdmins SCVMM Administrators security group
Add the “scvmmsvc” and “scvmmadmin” account to the “SCVMMAdmins” global group.
Add the domain user accounts for yourself and your team to the SCVMMAdmins group.
I suggest you to check this link for more details.
http://blogs.technet.com/b/kevinholman/archive/2013/10/18/scvmm-2012-r2-quickstart-deployment-guide.aspx
Girish Prajwal
I had this error and couldn't find an updated answer to the problem.
In my case, I have SCVMM (server AND console) installed on the same machine (i guess this is pretty normal for a first time installation).
I had seen the system working, then I installed all updates offered from Windows Update. After reboot, my service "System Center Virtual Machine Manager" could not start.
Solution was to look in control panel: "Programs and Features". Clicking "installed updates" there was an entry for System Center Console.
This was a rollup 10.
I uninstalled this, now the service is able to start, and I can log on.
Hope this helps someone.
This KB article from Microsoft addresses the issue- https://support.microsoft.com/en-us/kb/3045931
To resolve this issue, complete the update rollup installation by installing the VMM server update package in addition to the console update. Both the VMM server and VMM Admin Console updates must be at compatible version levels. This will typically be the same update rollup level. For example, a VMM Admin Console should be at the VMM UR5 level if the server is also at UR5.
In some instances, there may not be a comparable update for a component. In that case, the component should be updated to the most recent applicable update. For example, if the VMM server is updated to a post-UR5 hotfix, but there is no corresponding hotfix for the VMM Admin Console, the VMM Admin Console should be updated to UR5.
In my case update rollup 11 was the cause for the break. Going in to Programs and Features -> Installed Updates, I noticed that Update rollup 11 for the admin console had installed successfully but Update rollup 11 for the VMM service had failed.
I manually installed the failed update (in my case http://download.microsoft.com/download/7/5/1/7515E3DB-1B43-4E7F-8774-A877CCEAA96E/kb3184831_vmmserver_amd64.msp) and now VMM service is able to start and stay started.
I need to migrate a web service application from Tomcat 6 (using JDK 1.5) to Tomcat 7 (using JDK 1.6) (actually testing on 7.0.27). The JAX-WS framework is Metro 2.1.
I'm using two ServletContextListeners:
"WebAppListener" : to initialize the application (configuration, setup of database connections...).
"com.sun.xml.ws.transport.http.servlet.WSServletContextListener": the Metro listener that creates the web services.
The order is important, because I need my web app fully initialized before the #PostConstruct method is called on my web service.
In Tomcat 6, this works marvelously:
INFO: Starting Servlet Engine: Apache Tomcat/6.0.36
mars 16, 2013 5:13:13 PM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive WSWebApp.war
************************ IN WebAppListener.contextInitialized ***********************
************************ IN WSMyWebService.postConstruct ****************************
Exactly the same war however in Tomcat 7:
mars 16, 2013 6:45:24 PM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive C:\home\tomcat\webapps\WSWebApp.war
************************ IN WSMyWebService.postConstruct ****************************
************************ IN WebAppListener.contextInitialized ***********************
I thought that the order in which the listener's are called is the order in which they appear in the web.xml?
Why this order has been changed in Tomcat 7? But more importantly: What do I need to do to get the "Tomcat6" order back?
Thanks.
The answer lies in a difference between Servlet spec 2.5 and Servlet spec 3.0.
In Servlet spec 2.5, the order in which listeners are called is defined by the order of their declaration in the deployment descriptor (web.xml):
SRV.10.3.3 Listener Registration.
The Web container creates an
instance of each listener class and registers it for event
notifications prior to the processing of the first request by the
application. The Web container registers the listener instances
according to the interfaces they implement and the order in which
they appear in the deployment descriptor. During Web application
execution, listeners are invoked in the order of their registration.
In Servlet spec 3.0, the order in which listeners are called is defined by the element <absolute-ordering> in the deployment descriptor (web.xml):
8.2.3 Assembling the descriptor from web.xml, webfragment.xml and annotations. ... c. Prior to this release of the specification,
context listeners were invoked in random order.
This is wrong IMHO, as stated above in the version 2.5 spec. :-)
As of Servlet 3.0,
the listeners are invoked in the order in which they are declared in
the web.xml as specified below: i. Implementations of
javax.servlet.ServletContextListener are invoked at their
contextInitialized method in the order in which they have been
declared, and at their contextDestroyed method in reverse order.
This doesn't work at all like you'd expect and is the source of my trouble, confusion and a lost weekend. ;-)
It's NOT the same ordering as before (2.5 spec)!
But there is more... (the AHA moment is near!)
8.2.2 Ordering of web.xml and web-fragment.xml
Since the specification allows the application configuration resources
to be composed of multiple configuration files (web.xml and
web-fragment.xml), discovered and loaded from several different
places in the application, the question of ordering must be
addressed.
...
Two cases must be considered to allow application configuration
resources to express their ordering preferences.
1. Absolute ordering: an <absolute-ordering> element in the web.xml. a. In this case, ordering preferences that would have been handled by
case 2 below must be ignored.
2. Relative ordering: an <ordering> element within the web-fragment.xml. a. A web-fragment.xml may have an <ordering>
element. If so, this element must contain zero or one <before>
element and zero or one <after> element. The meaning of these elements
is explained below.
So, in my case, I had two options:
Stick with version 2.5 : This works well on Tomcat 6 and 7, but is only moving problems to the future.
Migrate to version 3.0 of the spec and adjust my deployment descriptor accordingly:
Update the version and schema in the web-app element, of course:
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
Adding a <absolute-ordering> element that defines the order in which the listeners should be processed:
<absolute-ordering> <name>bootstrap</name><name>ws</name><others/></absolute-ordering>
<listener id="bootstrap">
<listener-class>lu.estiedi.ws.WebAppBootstrap</listener-class>
</listener>
<listener id="ws">
<listener-class>com.sun.xml.ws.transport.http.servlet.WSServletContextListener</listener-class>
</listener>
Note the <others/> element : if it's not present, then the listeners that are not named will not be processed.
EDIT:
This doesn't actually solve the problem.
It went away yesterday at home, but this morning at work the solution didn't work. :-(
It looks like Metro is using a service provider ServletContainerInitializer, which are called before the Listeners.
If this is the way it's supposed to work, then the PosConstruct method is always called before the contextInitialized on Listeners.
Where do we initialise our application then, before the web services are created?
It is not about order of Listeners, it is about a new feature of servlets spec 3.0 and the fact that you are probably using a JAX-WS implementatios like METRO, I suppose.
In servlets spec 3.0 (chapter 8.2.4) there is a way to add 3rd party plugins or APIs to containers (Tomcat in this case), for example JAX-WS, JAX-RS, JSF, etc. implementations. It is also known ad SCI (javax.servlet.ServletContainerInitializer).
In short, METRO JAX-WS jars use this way so it is not mandatory to add listener (com.sun.xml.ws.transport.http.servlet.WSServletContextListener) and servlet configuration in your web.xml descriptor file. It uses sun-jaxws.xml file to list ws endpoints and instantiate ws classes before deployment of web application and execution, for example, of methods contextInitialized of listeners.
To avoid this, just follow instructions for avoiding SCI mechanism in Tomcat: How do I make Tomcat startup faster?
There exists an attribute on Context element, containerSciFilter. It can be used to disable container-provided features that are plugged into Tomcat via SCI API: WebSocket support (in Tomcat 7 and later), JSP support (in Tomcat 8 and later).
The class names to filter can be detected by looking into META-INF/services/javax.servlet.ServletContainerInitializer files in Tomcat JARs. For WebSocket support the name is org.apache.tomcat.websocket.server.WsSci, for JSP support the name is org.apache.jasper.servlet.JasperInitializer.
It worked for me with JAX-WS and it just uses web.xml config to deploy web services.
I'm attempting to set up some build controllers and agents in our TFS infrastructure. Our TFS server is setup as a build controller, and I have a few build agents set up as well.
When I queue a new build on my system, all appears to be well. No error messages appear, and the build appears in the queue on my system. However, that's all that ever happens. When I go to the page for the build in Visual Studio, it states it's been "Running for 0 seconds". Looking at the admin console on our TFS server, the controller states it's "Ready", but nothing more. All the agents are similarly listed as 'Ready'.
I'm not aware of any logs I can use to diagnose this issue. I've set the Logging Verbosity to 'Diagnostic', but options in the Diagnostics dropdown are greyed out. The activity is completely blank, as well.
Looking in the database on the build controller, the dbo.tbl_BuildController table does list the build. What I find odd, though, is the StartTime is NULL. If I stop the build in VS, the start time and the end time are set to the same thing in the database.
So, I know that the build is registering with the build controller, and that there's not a communication issue; the build just never starts, and never give an error. How can I resolve this? (or, at least get an error that I can chase down).
EDIT: The issue appears to be related to the TFS server. Here's what I uncovered in the event log:
WebHost failed to process a request.
Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/10411892
Exception: System.ServiceModel.ServiceActivationException: The service '/tfs/queue/GPA/Services/v4.0/MessageQueueService2.svc' cannot be activated due to an exception during compilation. The exception message is: This collection already contains an address with scheme http. There can be at most one address per scheme in this collection. If your service is being hosted in IIS you can fix the problem by setting 'system.serviceModel/serviceHostingEnvironment/multipleSiteBindingsEnabled' to true or specifying 'system.serviceModel/serviceHostingEnvironment/baseAddressPrefixFilters'.
Parameter name: item. ---> System.ArgumentException: This collection already contains an address with scheme http. There can be at most one address per scheme in this collection. If your service is being hosted in IIS you can fix the problem by setting 'system.serviceModel/serviceHostingEnvironment/multipleSiteBindingsEnabled' to true or specifying 'system.serviceModel/serviceHostingEnvironment/baseAddressPrefixFilters'.
Parameter name: item
at System.ServiceModel.UriSchemeKeyedCollection.InsertItem(Int32 index, Uri item)
at System.Collections.Generic.SynchronizedCollection1.Add(T item)
at System.ServiceModel.UriSchemeKeyedCollection..ctor(Uri[] addresses)
at System.ServiceModel.ServiceHost..ctor(Type serviceType, Uri[] baseAddresses)
at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(Type serviceType, Uri[] baseAddresses)
at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.CreateService(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(ServiceActivationInfo serviceActivationInfo, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
--- End of inner exception stack trace ---
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath, EventTraceActivity eventTraceActivity)
Process Name: w3wp
Process ID: 3756
I would start looking in the Event Log.
Control Panel -> Administrative Tools
Event Viewer
I am assuming that there will be some sort or error appearing in there. If your build agents are on a different machine, make sure you look in the event log there too.
Update from original posters comments
There was an exception in the Event Log which pointed us to here: TFS2012 Build Service offline
Go check the security settings of the user that is used for the build service properties. I've had almost the same issue and it was because I changed some security settings for that specific user where he suddenly could not build anymore.
To find the user:
Go to your TFS server
Open Team Foundation Server Administration Console
Open Build Configuration
Open Properties of the Build Service
This worked for me, password of the user account which was used to access TFS hosted on different Server expired.
Password reset fixed it for me.
The build controller and agent must run the same version of Team Foundation Build.
(Buid Service version is something like v4.0 or v4.1 and it is different from tfs product version which is some thing like 11.0.50727.1)
So, if the build Agent and controller are deployed in different machines, check the build service version on both machines. it must be the same.
TFS prevents to assign a build agent to a build controller with different build service version. However, you are allowed to upgrade one of the build machines to a different version (for example visual studio update 2) without detaching the controller and agent
in some cases the build service version stay unchanged (for example inspite of upgrading to update 2 the version stay v4.0)
in this situation if you want to apply the new version of build service
in tfs 2012 or 2013 to check the build service version:
Go to Build Machine
Open Team Foundation Server Administration Console
Open Build Configuration
Open Build Service properties (click on the properties link next to the unregister
link)
"Listen for build agent communication on" text box
to apply change of the build service version
stop the service
Click the "Change" button
set a different port number
reset the previous port number
immediately the build service version will change from v4.0 to v4.1
Although easily done from my perspective with IIS, I'm a total noob to Tomcat and have no idea how to set static values for cookie contents. Yes I've read the security implications and eventually will access via SSL so I'm not concerned. Plus I've read the Servlet 3.0 spec about not changing the value and I accept that.
In IIS I would simply set a HTTP Header named Set-Cookie with an arbitrary setting of WebServerSID and a value of 1001.
Then in the load balancer VIP containing this group of real servers, set the value WebServerSID at the VIP level, and for the first web server a cookie value of 1001 and so one for the remaining machines 1002 for server 2, 1003 for server 3.
This achieves session affinity via cookies until the client closes the browser.
How can this be done with Tomcat 7.0.22?
I see a great deal of configuration changes have occurred between Tomcat 6.x and 7.x with regard to cookies and how they're set up. I've tried the following after extensive research
over the last week.
In web.xml: (this will disable URL rewriting under Tomcat 7.x)
<tracking-mode>COOKIE</tracking-mode> under the default session element
In context.xml: (cookies is true by default but I was explicit as I can't get it working)
cookies=true
sessionCookiePath=/
sessionCookieName=WebServerSID
sessionCookieName=1001
I have 2 entries in context.xml for sessionCookieName because the equivalent commands from Tomcat 6.x look like they've been merged into 1.
See http://tomcat.apache.org/migration-7.html#Tomcat_7.0.x_configuration_file_differences
Extract:
org.apache.catalina.SESSION_COOKIE_NAME system property: This has been removed. An equivalent effect can be obtained by configuring the sessionCookieName attribute for the global context.xml (in CATALINA_BASE/conf/context.xml).
org.apache.catalina.SESSION_PARAMETER_NAME system property: This has been removed. An equivalent effect can be obtained by configuring the sessionCookieName attribute for the global context.xml (in CATALINA_BASE/conf/context.xml).
If this is not right then I simply do not understand the syntax that is required and I cannot find anywhere that will simply spell it out in plain black and white.
Under Tomcat 6.x, I would have used Java Options in the config like:
-Dorg.apache.catalina.SESSION_COOKIE_NAME=WebServerSID
-Dorg.apache.catalina.SESSION_PARAMETER_NAME=1001
The application I'm using does not have any of these values set elsewhere so it's not the application.
All these settings are in context/web/server.xml files at the Catalina base
At the end of the day what I need to see in the response headers under Set-Cookies: (as seen using Fiddler) is:
WebServerSID=1001
NOT
JSESSIONID=as8sd9787ksjds9d8sdjks89s898
thanks in advance
regards
The best you can do purely with configuration is to set the jvmRoute attribute of the Engine which will add the constant value to the end of the session ID. Most load-balancers can handle that. It would look like:
JSESSIONID=as8sd9787ksjds9d8sdjks89s898.route1
If that isn't good enough and you need WebServerSID=1001 you'll have to write a ServletFilter and configure that to add the header on every response.