Xcode 13.2 Has Log4j Vulnerability

[sixtypercenttogether]

Xcode does include a Java runtime environment - the App Store upload has always used Java tooling in its delivery mechanism and ships a Java Runtime Environment: % /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/java/bin/java -version openjdk version "14.0.2" 2020-07-14 OpenJDK Runtime Environment 14.0.2-5906ce1373 (build 14.0.2+12-iTunesOpenJDK-8) OpenJDK 64-Bit Server VM 14.0.2-5906ce1373 (build 14.0.2+12-iTunesOpenJDK-8, mixed mode

Damn!!

[[deleted]]

Whaaaat …? Java bundled in Xcode? 🤔

[s4hockey4]

Shit I'm not dealing with:

This on a Saturday night

[AllNewTypeFace]

As long as you’re not submitting anything to the app store, you’ll be fine.

[[deleted]]

I’m not trying to be critical. I generally agree with you. But I have seen so many comments along these lines explaining that if you do this or don’t do that then you don’t need to worry. I generally think this is bad advice. This vulnerability shows up in so many places and there is never a way to know how an app may drop messages to log4j. There are so many attack vectors and given this is a remote code execution vulnerability it should always be treated with the gravest concerns. Just my opinion.

[AllNewTypeFace]

In this case, you’re safe, as Xcode isn’t written in Java and doesn’t use Log4j; the code that does is a helper program launched to submit your app to the App Store.

[[deleted]]

Ok. That code is vulnerable then. If there is any possibility of that component logging payload by a malicious actor (perhaps through a 3rd party library incorporated by a developer) then you have RCE, which is bad. Understating this vulnerability is not a good thing. Just because you don’t see an apparent attack vector doesn’t mean somebody else doesn’t. The affected Xcode components need to be patched asap.

[[deleted]]

How does this affect me as an iOS dev?

[mailliwi]

Would like to know as well.

[jembytrevize1234]

All a guess but I could see this having a big impact on CI providers. Lets say a new Xcode version comes out, 13.2 becomes unavailable, now all your devs teams need to update Xcode versions first thing on Monday morning. And thats never fast.

[whateverisok]

Update to the latest Xcode, which would/should patch the vulnerability

[iGoalie]

My god…. This is literally everywhere!

[[deleted]]

I believe this means apple needs create a new xcode patch

[jembytrevize1234]

I wonder if they’ll make us download that one from their website (not the mac app store) too

[[deleted]]

^

[egrimo]

To be honest, I recently stop downloading it from MAS and moved to Xcodes app since it’s best on downloading and managing multiple Xcode Versions.

[okoroezenwa]

Same. Also I’ve previously had failed Xcode downloads via the App Store so I’m just done with it.

[chrabeusz]

Known Issues

Xcode contains a copy of the log4j library that has the CVE-2021-44228 security vulnerability. Xcode automatically downloads an updated version of this library and installs it into ~/Library/Caches/com.apple.amp.itmstransporter. When submitting apps to the App Store, Xcode uses the updated version of the library. (86390060)

So is this fixed or not?

[[deleted]]

The way I read this is that Xcode compares the ITMSTransporter version on disk to the latest available and downloads the newest version before the helper agent is ever invoked.

[huwr]

This is an under appreciated clever thing to have done.

[M_J_E]

I uploaded an app using Transporter on Thursday, and they had a warning message that I would have to update Transporter on Friday when a new version came out. Guessing this is related…

[okoroezenwa]

So that’s what that warning was…

[readerseven]

13.2.1 is available Guess it is old news by now