[IMPORTANT] Log4j CVE-2021-44228 漏洞影响说明

# [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) Announce

Recently, the mainstream log framework [log4j2](https://logging.apache.org/log4j/2.x/) was reported with a severe security vulnerability [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).

The following is a summary of the impact of this vulnerability [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) on Sentinel and the user's guide.

## Potential influence on Sentinel

CVE-2021-44228 has NO security impact on use of Sentinel.

Sentinel itself does not rely on the `log4j2-core` framework, nor will it bring log4j2-core to the project through dependency transfer. Therefore, users do not need to upgrade their Sentinel versions.

The following is the dependency analysis of Sentinel modules on log4j2:

- `sentinel-datasource-spring-cloud-config`, `sentinel-datasource-eureka`, `sentinel-apache-httpclient-adapter`, `sentinel-spring-webflux-adapter`, `com.alibaba.csp:sentinel-spring-cloud-gateway-adapter`, `sentinel-spring-webmvc-adapter`, `sentinel-okhttp-adapter`, `sentinel-jax-rs-adapter` transfers log4j-api dependency through spring-boot under `test` scope or `provided` scope. log4j-api itself has no security issue.

- Sentinel dashboard transfers log4j-api dependency through spring-boot. log4j-api itself has no security issue.

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ sentinel-dashboard ---
[INFO] com.alibaba.csp:sentinel-dashboard:jar:1.8.2
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.0.5.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.10.0:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.10.0:compile
```

- Some of the demo modules, including `sentinel-demo-annotation-spring-aop`, `sentinel-demo-cluster-embedded`, `sentinel-demo-spring-webflux`, `sentinel-demo-apache-httpclient`, `sentinel-demo-spring-cloud-gateway`, `sentinel-demo-zuul-gateway`, `sentinel-demo-spring-webmvc`, `sentinel-demo-okhttp`, `sentinel-demo-jax-rs`, `sentinel-demo-transport-spring-mvc`, transfers log4j-api dependency through spring-boot. log4j-api itself has no security issue, and these demo modules were not deployed to Maven (only as sample projects).

- Some of the demo modules, including `sentinel-demo-apollo-datasource`, indirectly introduces `log4j-core` through `org.apache.logging.log4j:log4j-slf4j-impl` module. The demo modules were not deployed to Maven (only as sample projects). The dependencies has been upgraded:

```
NOTE: only a DEMO project, not deployed
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ sentinel-demo-apollo-datasource ---
[INFO] com.alibaba.csp:sentinel-demo-apollo-datasource:jar:1.8.2
[INFO] \- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.15.0:compile
[INFO] +- org.apache.logging.log4j:log4j-api:jar:2.15.0:compile
[INFO] \- org.apache.logging.log4j:log4j-core:jar:2.15.0:runtime
```

In addition to the components shown above, other components don't depend on log4j-core.

# [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) 漏洞说明

最近，主流日志组件 [log4j2](https://logging.apache.org/log4j/2.x/) 爆出安全漏洞 [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)。

以下是漏洞 [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) 对 Sentinel 的影响总结及用户应对指南。

## Sentinel 影响范围

CVE-2021-44228 该漏洞对 Sentinel 使用安全并无影响。

Sentinel 本身不强依赖 `log4j2-core` 框架，也不会通过依赖传递将 `log4j2-core` 带到业务工程中去，因此，正在使用 Sentinel 的用户无需担心 Sentinel 自身组件代码会受该次安全漏洞影响。

以下是 Sentinel 部分模块对 log4j2 的依赖分析：

- `sentinel-datasource-spring-cloud-config`, `sentinel-datasource-eureka`, `sentinel-apache-httpclient-adapter`, `sentinel-spring-webflux-adapter`, `com.alibaba.csp:sentinel-spring-cloud-gateway-adapter`, `sentinel-spring-webmvc-adapter`, `sentinel-okhttp-adapter`, `sentinel-jax-rs-adapter` 这些模块通过部分 Spring 模块传递了 log4j-api 依赖，并且都是 test 或 provided scope，非直接依赖。log4j-api 本身并无安全问题，且非直接依赖的版本不影响用户实际引用版本。

- Sentinel 控制台项目通过 spring-boot 组件传递了 log4j-api 依赖，log4j-api 本身并无安全问题。

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ sentinel-dashboard ---
[INFO] com.alibaba.csp:sentinel-dashboard:jar:1.8.2
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.0.5.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.10.0:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.10.0:compile
```

- 部分示例 demo 项目，包括 `sentinel-demo-annotation-spring-aop`, `sentinel-demo-cluster-embedded`, `sentinel-demo-spring-webflux`, `sentinel-demo-apache-httpclient`, `sentinel-demo-spring-cloud-gateway`, `sentinel-demo-zuul-gateway`, `sentinel-demo-spring-webmvc`, `sentinel-demo-okhttp`, `sentinel-demo-jax-rs`, `sentinel-demo-transport-spring-mvc`，通过 spring-boot 组件传递了 log4j-api 依赖。log4j-api 本身并无安全问题，并且这些模块仅作为示例项目，不作为 Sentinel 正式模块发布至 Maven 仓库。

- 部分示例 demo 项目，包括 `sentinel-demo-apollo-datasource` 模块，通过 `org.apache.logging.log4j:log4j-slf4j-impl` 间接依赖了 `log4j-core` 模块。该模块仅作为示例项目，不作为 Sentinel 正式模块发布至 Maven 仓库，因此无实际风险；同时为防止潜在的安全隐患，该版本已经升级至最新版本：

```
NOTE: only a DEMO project, not deployed
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ sentinel-demo-apollo-datasource ---
[INFO] com.alibaba.csp:sentinel-demo-apollo-datasource:jar:1.8.2
[INFO] \- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.15.0:compile
[INFO] +- org.apache.logging.log4j:log4j-api:jar:2.15.0:compile
[INFO] \- org.apache.logging.log4j:log4j-core:jar:2.15.0:runtime
```

除了上述组件，其他组件与 log4j-core 模块无关。

The issue contains a bilingual CVE-2021-44228 impact notice but names no repository file or test. Review the linked advisory and the listed Maven dependency trees first; done means the published Sentinel guidance accurately describes affected modules, scopes, and Log4j versions.

Written by the indexing model from the issue text.