apache / apache/logging-log4j2

Update encryption algorithms in Flume appender

Open
#1,947 1 comment 0 reactions 0 assignees View on GitHub
appenders appenders:Flume
Dominant language
Java
Stars
3.6k
Forks
1.7k
Avg merge
21h 30m
Merged PRs (30d)
27

Description

## Description

The Flume appender uses:
```java
Cipher.getInstance("AES");
```
to encrypt messages

In the default [Oracle security providers](https://docs.oracle.com/en/java/javase/17/security/oracle-providers.html#GUID-BC92B7F1-D15C-432A-B725-9BBA9FEF61DB) this uses `ECB` as cipher mode, which:

- does not provide integrity (cf. [CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)),
- does not provide good confidentiality (cf. [ECB_MODE](https://find-sec-bugs.github.io/bugs.htm#ECB_MODE)).

If Flume supports it, we should replace it with another cipher mode.

Related to #1707.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.