update log4j to 2.15.0 to address security vulnerabilities

[xvrl]

fixes #12050

[FrankChen021]

@xvrl You're so quick. Why can't I find the 2.15.0 artifact on the mvnrepository.com?

[clintropolis]

it probably hasn't propagated to all of the mirrors yet, I see it here https://search.maven.org/search?q=g:org.apache.logging.log4j

[a2l007]

Not sure if we know at this point if 2.15.0 will completely resolve this issue, but operators must be setting -Dlog4j2.formatMsgNoLookups=true in their jvm args meanwhile.

[suneet-s]

log4j's official announcement is here https://lists.apache.org/thread/bfnl1stql187jytr0t5k0hv0go6b76g4

Based on this, operators could add %m{nolookups} to the PatternLayout in log4j2.xml since we use log4j version 2.8.2 -Dlog4j2.formatMsgNoLookups=true will not work

[a2l007]

Thanks for clarifying @suneet-s

[dongjoon-hyun]

Thank you all!

[GElkayam]

@xvrl , @clintropolis , Is this going to get updated to 2.16 to mitigate CVE-2021-45046?
Nevermind, addressed in #12061

[FrankChen021]

@GElkayam I checked the description of that CVE. If I understand correctly, this vulnerability exists when thread context map pattern layout is applied.

Since Druid's default log4j2 configuration does not use such pattern layout, I think it's not affected by this problem.

This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack.