Fail closed when a `KeyStore` or `TrustStore` element of `Ssl` cannot be loaded

Open
#4,332 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
java
Domain
security

Research direction

Start by tracing TrustStoreConfiguration#createKeyStoreConfiguration through PluginBuilder and SslConfiguration#createSSLConfiguration, then inspect SslConfiguration#createSslContext and the TLS configuration rework in #2792 and #3902. Done means a present but invalid KeyStore or TrustStore prevents the Ssl element and enclosing appender from starting, without falling back to the default SSL context.

Written by the indexing model from the issue text.

Description

When a TrustStore (or KeyStore) element of Ssl cannot be loaded, for example because the file is missing or the password is wrong, TrustStoreConfiguration#createKeyStoreConfiguration throws StoreConfigurationException, PluginBuilder logs an error and returns null for the element, and SslConfiguration#createSSLConfiguration receives null exactly as if the element had been absent. The SSLContext is then initialized with null trust managers, i.e. the JVM default trust store. Independently, SslConfiguration#createSslContext catches any initialization error and falls back to SSLContext.getDefault().

This is not a vulnerability: the configuration is trusted input under the threat model and the failure is reported at ERROR level by the status logger. It is, however, a fail-open behavior for a security-relevant element: a deployer who restricted trust to a private CA ends up with the default trust store after a password rotation or a missing volume mount. This issue originates from a private security report classified as hardening.

Proposal: when a KeyStore or TrustStore child element is present but invalid, the Ssl element should fail to build and the enclosing appender should fail to start. One way is to let the store factories return a configuration object that records the failure instead of throwing, and have SslConfiguration reject it; the default-context fallback in createSslContext should also be removed. This fits the TLS configuration rework tracked in #2792 and #3902.

Reported by @August829

Dominant language
Java
Stars
3.6k
Forks
1.7k
Avg merge
3d 13h
Merged PRs (30d)
35

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/logging-log4j2

All issues in apache/logging-log4j2

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.