[Announce] Log4j CVE-2021-44228 安全漏洞影响说明

# [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) Announce
Recently, the mainstream log framework [log4j2](https://logging.apache.org/log4j/2.x/) was reported with a severe security vulnerability [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).

The following is a summary of the impact of this vulnerability [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) on the Seata.

## Potential Influence on Seata
[CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) **has NO security impact on use of Seata**.

`log4j-core` dependency are not referenced directly or indirectly in the Seata project
So you don't need to upgrade the version of Seata for security reasons.

Seata currently contains 82 modules. The following is the dependency analysis of Seata modules on log4j2.

mvn cmd：

`mvn dependency:tree -Dverbose -Dincludes=org.apache.logging.log4j`

`seata-console` transfers log4j-api dependency through spring-boot. log4j-api itself has no security issue.In addition,'seata-console' is a newly added module that has not yet been released.

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-console ---
[INFO] io.seata:seata-console:jar:1.5.0-SNAPSHOT
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
```

* `seata-server` transfers log4j-api dependency through spring-boot. log4j-api itself has no security issue.

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-server ---
[INFO] io.seata:seata-server:jar:1.5.0-SNAPSHOT
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
```

* `seata-distribution` 通过 spring-boot web 组件传递了 log4j-api 依赖，log4j-api 本身并无安全问题

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-distribution ---
[INFO] io.seata:seata-distribution:pom:1.5.0-SNAPSHOT
[INFO] \- io.seata:seata-server:jar:1.5.0-SNAPSHOT:compile
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
```

* ` apm-seata-skywalking-plugin` transfers log4j-api dependency through spring-boot web. log4j-api itself has no security issue.

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ apm-seata-skywalking-plugin ---
[WARNING] Invalid POM for com.alibaba:druid:jar:1.2.6, transitive dependencies (if any) will not be available, enable debug logging for more details
[WARNING] Invalid POM for com.alibaba:druid:jar:1.2.6, transitive dependencies (if any) will not be available, enable debug logging for more details
[INFO] io.seata:apm-seata-skywalking-plugin:jar:1.5.0-SNAPSHOT
[INFO] \- io.seata:seata-server:jar:1.5.0-SNAPSHOT:provided
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:provided
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:provided
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:provided
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:provided
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:provided
```

In addition to the modules shown above, other modules don't depend on `org.apache.logging.log4j`.
Meanwhile, we have analyzed [seata-samples](https://github.com/seata/seata-samples) and found no dependency on `log4j-core`, so the security vulnerability does not affect seata-samples.
Finally, the Seata community urges people not to exploit security vulnerabilities, to report undiscovered security vulnerabilities, and not to discuss them publicly.

# [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) 漏洞说明
最近，主流日志组件 [log4j2](https://logging.apache.org/log4j/2.x/) 爆出安全漏洞 [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)。

以下是漏洞 [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) 对 Seata 的影响说明。

## Seata 影响范围
[CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) **该漏洞并未对 Seata 造成安全影响**。

Seata 的项目中并未直接或间接依赖 `log4j-core`, 所以你不需要因为安全性问题而升级Seata的版本。

Seata 共包含82个模块。以下是 Seata 模块对 log4j2 的依赖分析：

mvn 命令：

`mvn dependency:tree -Dverbose -Dincludes=org.apache.logging.log4j`

* `seata-console` 通过 spring-boot 组件传递了 log4j-api 依赖，log4j-api 本身并无安全问题。另外，`seata-console` 是一个最新添加尚未发布的模块。

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-console ---
[INFO] io.seata:seata-console:jar:1.5.0-SNAPSHOT
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile

```

* `seata-server` 通过 spring-boot 组件传递了 log4j-api 依赖，log4j-api 本身并无安全问题

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-server ---
[INFO] io.seata:seata-server:jar:1.5.0-SNAPSHOT
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
```

* `seata-distribution` 通过 spring-boot web 组件传递了 log4j-api 依赖，log4j-api 本身并无安全问题

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ seata-distribution ---
[INFO] io.seata:seata-distribution:pom:1.5.0-SNAPSHOT
[INFO] \- io.seata:seata-server:jar:1.5.0-SNAPSHOT:compile
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:compile
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
```

* ` apm-seata-skywalking-plugin` transfers log4j-api dependency through spring-boot web. log4j-api itself has no security issue.

```
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ apm-seata-skywalking-plugin ---
[WARNING] Invalid POM for com.alibaba:druid:jar:1.2.6, transitive dependencies (if any) will not be available, enable debug logging for more details
[WARNING] Invalid POM for com.alibaba:druid:jar:1.2.6, transitive dependencies (if any) will not be available, enable debug logging for more details
[INFO] io.seata:apm-seata-skywalking-plugin:jar:1.5.0-SNAPSHOT
[INFO] \- io.seata:seata-server:jar:1.5.0-SNAPSHOT:provided
[INFO] \- org.springframework.boot:spring-boot-starter-web:jar:2.3.10.RELEASE:provided
[INFO] \- org.springframework.boot:spring-boot-starter:jar:2.3.10.RELEASE:provided
[INFO] \- org.springframework.boot:spring-boot-starter-logging:jar:2.3.10.RELEASE:provided
[INFO] \- org.apache.logging.log4j:log4j-to-slf4j:jar:2.13.3:provided
[INFO] \- org.apache.logging.log4j:log4j-api:jar:2.13.3:provided
```

除了上述模块，其他模块也是没有依赖 org.apache.logging.log4j。
同时，我们对 [seata-samples](https://github.com/seata/seata-samples) 进行了分析，未发现依赖 `log4j-core`，因此这个安全漏洞不影响 `seata-samples`.
最后，Seata 社区希望大家不要利用安全漏洞信息，及时上报未发现的安全漏洞，不要在公开场合讨论它们。

No source file or test is named; this issue is an advisory announcement rather than a defined code task. Start with the documented `mvn dependency:tree -Dverbose -Dincludes=org.apache.logging.log4j` command and review the listed Seata modules. Done would mean confirming whether `log4j-core` is present and documenting the verified impact, but the issue does not specify a requested change.

Written by the indexing model from the issue text.