GHSA-3w6p-8f82-gw8r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3w6p-8f82-gw8r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-3w6p-8f82-gw8r/GHSA-3w6p-8f82-gw8r.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3w6p-8f82-gw8r
- Published
- 2021-12-17T20:42:38Z
- Modified
- 2024-12-03T06:08:49.894411Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
- Details
-
Impact
ClickHouse JDBC Bridge uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.
Patches
The patch version
2.0.7removed log4j dependency by replacingslf4j-log4j12toslf4j-jdk14. Logging configuration is also changed fromlog4j.propertiestologging.properties.Workarounds
- Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
- Alternatively, you can issue below command to remove
JMSAppender.class:
```(bash)
install zip command if you don't have
apt-get update && apt-get install -y zip
remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class ```
References
Please refer to CVE-2021-4104 to read more.
For more information
If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-502" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2021-12-17T20:34:04Z" }- References
Affected packages
Maven / ru.yandex.clickhouse:clickhouse-jdbc-bridge
Package
- Name
- ru.yandex.clickhouse:clickhouse-jdbc-bridge
- View open source insights on deps.dev
- Purl
- pkg:maven/ru.yandex.clickhouse/clickhouse-jdbc-bridge