Fail closed when a `KeyStore` or `TrustStore` element of `Ssl` cannot be loaded
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start by tracing TrustStoreConfiguration#createKeyStoreConfiguration through PluginBuilder and SslConfiguration#createSSLConfiguration, then inspect SslConfiguration#createSslContext and the TLS configuration rework in #2792 and #3902. Done means a present but invalid KeyStore or TrustStore prevents the Ssl element and enclosing appender from starting, without falling back to the default SSL context.
Written by the indexing model from the issue text.
Description
When a TrustStore (or KeyStore) element of Ssl cannot be loaded, for example because the file is missing or the password is wrong, TrustStoreConfiguration#createKeyStoreConfiguration throws StoreConfigurationException, PluginBuilder logs an error and returns null for the element, and SslConfiguration#createSSLConfiguration receives null exactly as if the element had been absent. The SSLContext is then initialized with null trust managers, i.e. the JVM default trust store. Independently, SslConfiguration#createSslContext catches any initialization error and falls back to SSLContext.getDefault().
This is not a vulnerability: the configuration is trusted input under the threat model and the failure is reported at ERROR level by the status logger. It is, however, a fail-open behavior for a security-relevant element: a deployer who restricted trust to a private CA ends up with the default trust store after a password rotation or a missing volume mount. This issue originates from a private security report classified as hardening.
Proposal: when a KeyStore or TrustStore child element is present but invalid, the Ssl element should fail to build and the enclosing appender should fail to start. One way is to let the store factories return a configuration object that records the failure instead of throwing, and have SslConfiguration reject it; the default-context fallback in createSslContext should also be removed. This fits the TLS configuration rework tracked in #2792 and #3902.
Reported by @August829
- Dominant language
- Java
- Stars
- 3.6k
- Forks
- 1.7k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 35
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/logging-log4j2
-
waiting-for-maintainer
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/logging-log4j2#4318 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 74/100
apache/logging-log4j2#4333 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
apache/logging-log4j2#4331 ·
-
waiting-for-maintainer
Difficulty 4/5 3-5 days Newbie friendliness 35/100
apache/logging-log4j2#4328 ·
-
waiting-for-maintainer
Difficulty 4/5 3-5 days Newbie friendliness 48/100
apache/logging-log4j2#4309 ·
All issues in apache/logging-log4j2
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
objectionary/hone-maven-plugin#1061 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
spring-projects/spring-modulith#1895 ·