CVE-2021-44228 about keycloak-radius-plugin

[vzakharchenko]

Hi @mosaic-nick ,
"keycloak-radius-plugin" has already switched to using Log4J 2.15.0, but keycloak is still not released with new version of Log4J.

When a new version of keycloak will be appeared, then I will create a new release of the keycloak-radius-plugin.

Thanks,
Vasyl Zakharchenko

[mosaic-nick]

Hi @vzakharchenko,

Thanks for the quick response! And I'm glad to hear you have already updated Log4J on your side.

According to keycloak/keycloak#9078, Keycloak itself does not actually use log4j-core, which is where the vulnerability sits, as it uses the JBoss logging manager.

I remain curious as to whether you need the log4j dependency at all - it's not used anywhere in your code as far as I can see, and I have developed Keycloak plugins myself that write to the Keycloak logs and haven't required it.

In the meantime, we have mitigated the risk by disabling the JNDI lookup functionality on the command-line.

Thanks,
Nick