[SDNC] Mediate log4shell vulnerability

Add Java system property setting to remediate day zero vulnerability,
pending more permanent fix (upgrade CCSDK/SDNC to log4j v2.15.0, and
upgrade to a version of OpenDaylight that has upgraded as well).

Issue-ID: CCSDK-3556
Signed-off-by: Dan Timoney <dtimoney@att.com>
Change-Id: Id2a9e2743490daa23f3fa51f10a43beb91290e0b

diff --git a/kubernetes/sdnc/components/dmaap-listener/templates/deployment.yaml b/kubernetes/sdnc/components/dmaap-listener/templates/deployment.yaml
index 69b0fd3..b788a36 100644 (file)
--- a/kubernetes/sdnc/components/dmaap-listener/templates/deployment.yaml
+++ b/kubernetes/sdnc/components/dmaap-listener/templates/deployment.yaml
@@ -79,6 +79,8 @@ spec:
           value: "{{ .Values.config.configDir }}"
         - name: SDNC_CONFIG_DIR
           value: "{{ .Values.config.configDir }}"
+        - name: LOG4J_FORMAT_MSG_NO_LOOKUPS
+          value: "true"
         volumeMounts:
         - mountPath: /etc/localtime
           name: localtime

diff --git a/kubernetes/sdnc/components/ueb-listener/templates/deployment.yaml b/kubernetes/sdnc/components/ueb-listener/templates/deployment.yaml
index 603f3a3..a23a6af 100644 (file)
--- a/kubernetes/sdnc/components/ueb-listener/templates/deployment.yaml
+++ b/kubernetes/sdnc/components/ueb-listener/templates/deployment.yaml
@@ -84,6 +84,8 @@ spec:
           value: "{{ .Values.config.configDir }}"
         - name: SDNC_CONFIG_DIR
           value: "{{ .Values.config.configDir }}"
+        - name: LOG4J_FORMAT_MSG_NO_LOOKUPS
+          value: "true"
         volumeMounts:
         - mountPath: /etc/localtime
           name: localtime

diff --git a/kubernetes/sdnc/templates/statefulset.yaml b/kubernetes/sdnc/templates/statefulset.yaml
index f53c41c..d252c9a 100644 (file)
--- a/kubernetes/sdnc/templates/statefulset.yaml
+++ b/kubernetes/sdnc/templates/statefulset.yaml
@@ -285,6 +285,8 @@ spec:
             value: "{{ .Values.config.javaHome}}"
           - name: JAVA_OPTS
             value: "-Xms{{.Values.config.odl.javaOptions.minMemory}} -Xmx{{.Values.config.odl.javaOptions.maxMemory}}"
+          - name: LOG4J_FORMAT_MSG_NO_LOOKUPS
+            value: "true"
           - name: KARAF_CONSOLE_LOG_LEVEL
             value: "{{ include "common.log.level" . }}"
           - name: SDNRWT