Backport fix for CVE-2017-5645

0001-Backport-fix-for-CVE-2017-5645.patch

@@ -0,0 +1,134 @@
+From 3418715bde9a2944a40773f418976ecca1c8f05f Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Fri, 21 Apr 2017 16:45:43 +0200
+Subject: [PATCH] Backport fix for CVE-2017-5645
+
+---
+ .../server/ObjectInputStreamLogEventBridge.java    | 21 ++++++-
+ .../log4j/core/util/FilteredObjectInputStream.java | 67 ++++++++++++++++++++++
+ 2 files changed, 87 insertions(+), 1 deletion(-)
+ create mode 100644 log4j-core/src/main/java/org/apache/logging/log4j/core/util/FilteredObjectInputStream.java
+
+diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/server/ObjectInputStreamLogEventBridge.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/server/ObjectInputStreamLogEventBridge.java
+index 059f069..25a690d 100644
+--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/server/ObjectInputStreamLogEventBridge.java
++++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/server/ObjectInputStreamLogEventBridge.java
+@@ -19,15 +19,34 @@ package org.apache.logging.log4j.core.net.server;
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.ObjectInputStream;
++import java.util.Collections;
++import java.util.List;
+ 
+ import org.apache.logging.log4j.core.LogEvent;
+ import org.apache.logging.log4j.core.LogEventListener;
++import org.apache.logging.log4j.core.util.FilteredObjectInputStream;
+ 
+ /**
+  * Reads and logs serialized {@link LogEvent} objects from an {@link ObjectInputStream}.
+  */
+ public class ObjectInputStreamLogEventBridge extends AbstractLogEventBridge<ObjectInputStream> {
+ 
++    private final List<String> allowedClasses;
++
++    public ObjectInputStreamLogEventBridge() {
++        this(Collections.<String>emptyList());
++    }
++
++    /**
++     * Constructs an ObjectInputStreamLogEventBridge with additional allowed classes to deserialize.
++     *
++     * @param allowedClasses class names to also allow for deserialization
++     * @since 2.8.2
++     */
++    public ObjectInputStreamLogEventBridge(final List<String> allowedClasses) {
++        this.allowedClasses = allowedClasses;
++    }
++
+     @Override
+     public void logEvents(final ObjectInputStream inputStream, final LogEventListener logEventListener)
+             throws IOException {
+@@ -40,6 +59,6 @@ public class ObjectInputStreamLogEventBridge extends AbstractLogEventBridge<Obje
+ 
+     @Override
+     public ObjectInputStream wrapStream(final InputStream inputStream) throws IOException {
+-        return new ObjectInputStream(inputStream);
++        return new FilteredObjectInputStream(inputStream, allowedClasses);
+     }
+ }
+diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/util/FilteredObjectInputStream.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/util/FilteredObjectInputStream.java
+new file mode 100644
+index 0000000..57cc31c
+--- /dev/null
++++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/util/FilteredObjectInputStream.java
+@@ -0,0 +1,67 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements. See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache license, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the license for the specific language governing permissions and
++ * limitations under the license.
++ */
++package org.apache.logging.log4j.core.util;
++
++import java.io.IOException;
++import java.io.InputStream;
++import java.io.InvalidObjectException;
++import java.io.ObjectInputStream;
++import java.io.ObjectStreamClass;
++import java.util.Arrays;
++import java.util.Collection;
++import java.util.List;
++
++/**
++ * Extended ObjectInputStream that only allows certain classes to be deserialized.
++ *
++ * @since 2.8.2
++ */
++public class FilteredObjectInputStream extends ObjectInputStream {
++
++    private static final List<String> REQUIRED_JAVA_CLASSES = Arrays.asList(
++        // for StandardLevel
++        "java.lang.Enum",
++        // for location information
++        "java.lang.StackTraceElement",
++        // for Message delegate
++        "java.rmi.MarshalledObject",
++        "[B"
++    );
++
++    private final Collection<String> allowedClasses;
++
++    public FilteredObjectInputStream(final InputStream in, final Collection<String> allowedClasses) throws IOException {
++        super(in);
++        this.allowedClasses = allowedClasses;
++    }
++
++    @Override
++    protected Class<?> resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException {
++        String name = desc.getName();
++        if (!(isAllowedByDefault(name) || allowedClasses.contains(name))) {
++            throw new InvalidObjectException("Class is not allowed for deserialization: " + name);
++        }
++        return super.resolveClass(desc);
++    }
++
++    private static boolean isAllowedByDefault(final String name) {
++        return name.startsWith("org.apache.logging.log4j.") ||
++            name.startsWith("[Lorg.apache.logging.log4j.") ||
++            REQUIRED_JAVA_CLASSES.contains(name);
++    }
++
++}
+-- 
+2.9.3
+

log4j.spec

@@ -1,12 +1,14 @@
 Name:           log4j
 Version:        2.5
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        Java logging package
 BuildArch:      noarch
 License:        ASL 2.0
 URL:            http://logging.apache.org/%{name}
 Source0:        http://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz
 
+Patch0:         0001-Backport-fix-for-CVE-2017-5645.patch
+
 BuildRequires:  maven-local
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-core)
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-databind)
@@ -111,6 +113,8 @@ Obsoletes:      %{name}-manual < %{version}
 %prep
 %setup -q -n apache-%{name}-%{version}-src
 
+%patch0 -p1
+
 %pom_remove_plugin -r :maven-site-plugin
 %pom_remove_plugin -r :maven-remote-resources-plugin
 
@@ -218,6 +222,9 @@ fi
 
 
 %changelog
+* Fri Apr 21 2017 Michael Simacek <msimacek@redhat.com> - 2.5-5
+- Backport fix for CVE-2017-5645
+
 * Thu Jun 16 2016 Mikolaj Izdebski <mizdebsk@redhat.com> - 2.5-4
 - Remove RAT depenency from BOM package