Correct! In the works right now and I will once again post when I have the release details for next version of Streaming Engine. Great question to ask, thanks @Bernhard_Schmidt
Hi, the fix generates the following errors.
It’s normal?
where am i wrong?
thx!
gestione@WowzaStreaming:/usr/local/WowzaStreamingEngine/updates/updatelog4j$ sudo ./updatelog4j.sh
Verifying running as administrative user
updating /usr/local/WowzaStreamingEngine/lib
deleteing /usr/local/WowzaStreamingEngine/lib/log4j-api-2.16.0.jar
copying ./log4j-api-2.16.0.jar to /usr/local/WowzaStreamingEngine/lib/
deleteing /usr/local/WowzaStreamingEngine/lib/log4j-core-2.16.0.jar
copying ./log4j-core-2.16.0.jar to /usr/local/WowzaStreamingEngine/lib/
updating /usr/local/WowzaStreamingEngine/manager/lib/WMSManager.war
./updatelog4j.sh: riga 63: zip: comando non trovato
./updatelog4j.sh: riga 64: zip: comando non trovato
./updatelog4j.sh: riga 71: zip: comando non trovato
./updatelog4j.sh: riga 72: zip: comando non trovato
Update Complete. Please restart services
gestione@WowzaStreaming:/usr/local/WowzaStreamingEngine/updates/updatelog4j$
I too saw that, in english, on our linux wowza server.
Hi, @Piero_Ragazzini
I also had the same errors.
If zip command was not installed, I think that updatelog4j.sh doedn’t work properly.
I installed zip into OS, then executed updatelog4j.sh again.
1 Like
solved thanks to your advice! thank you
are you investigating earlier versions of log4j 1.X and vulnerability CVE-2021-4104 ? thank you
Thank you for posting about the zip command and we did get this updated as well!
I’m trying to keep all the updates in this thread in one place for “accepted solution” so let me add this new update to the green checkmark solution post.
No we are nor @Pedro_Costa
Unless the customer has changed the default settings of the JMSAppender (which we do not even use), we are not exposed to this CVE. If you have concerns, please update to 4.8.8.01 or higher.
Please send a support ticket for the engineers to review @Piero_Ragazzini . Not sure if it’s wrong or something in your server environment, but technical support can help you resolve it.
Installing zip with ‘apt install zip’ took care of those errors for me that Piero_Ragazzini was referring to.
I did it but @Yuichi_OHKAWA gave me the correct answer.
thx
1 Like
Important: Security Vulnerability CVE-2021-45105
The Log4j team has been made aware of a security vulnerability, CVE-2021-45105, that has been addressed in Log4j 2.17.0 for Java 8 and up.
Summary: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation.
It would also be nice if the Wowza Team do update the log4j*.jar Files in the Updater (and Installer!?) File for Wowza 4.8.16+1. At the Moment we have log4j Version 2.13.3 in the /lib Folders.
Please continue to check my post above for updates in the post with a green checkmark.
As far as updaters and installers @Marcel_Linke Also that updater with 2.16 was released last week so you must have missed my update. Keep checking our doc too that I posted. As the information has changed over the weekend from Apache, we have had to release a new updater today (Monday) to include Apache 2.17. This is a dynamic situation with Apache and we are updating accordingly as info comes in.
Please keep yourself informed by following my main post here.
I JUST POSTED A NEW UPDATE: MONDAY 12.20
CVE-2021-44832 and 2.17.1 are now released. Does this impact Wowza as it’s currently configured out of the box and/or with the suggested start changes to Manager and Engine?
1 Like