GHSA-8489-44mv-ggj8

Source

https://github.com/advisories/GHSA-8489-44mv-ggj8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8489-44mv-ggj8

Aliases

CVE-2021-44832

Published

2022-01-04T16:14:20Z

Modified

2024-02-20T05:37:46.713425Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Input Validation and Injection in Apache Log4j2

Details

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Affected packages

Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.

This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.

Database specific

{
    "nvd_published_at": "2021-12-28T20:15:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-74"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-28T21:14:19Z"
}

References

Affected packages

Maven / org.apache.logging.log4j:log4j-core

Package

Name: org.apache.logging.log4j:log4j-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.logging.log4j/log4j-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0-beta7

Fixed

2.3.2

Affected versions

2.*

2.0-beta7

2.0-beta8

2.0-beta9

2.0-rc1

2.0-rc2

2.0

2.0.1

2.0.2

2.1

2.2

2.3

2.3.1

Maven / org.apache.logging.log4j:log4j-core

Package

Name: org.apache.logging.log4j:log4j-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.logging.log4j/log4j-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4

Fixed

2.12.4

Affected versions

2.*

2.4

2.4.1

2.5

2.6

2.6.1

2.6.2

2.7

2.8

2.8.1

2.8.2

2.9.0

2.9.1

2.10.0

2.11.0

2.11.1

2.11.2

2.12.0

2.12.1

2.12.2

2.12.3

Maven / org.apache.logging.log4j:log4j-core

Package

Name: org.apache.logging.log4j:log4j-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.logging.log4j/log4j-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.13.0

Fixed

2.17.1

Affected versions

2.*

2.13.0

2.13.1

2.13.2

2.13.3

2.14.0

2.14.1

2.15.0

2.16.0

2.17.0