UBUNTU-CVE-2021-4104

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-4104

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-4104.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-4104

Related

Published

2021-12-14T12:15:00Z

Modified

2024-10-15T14:08:25Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

References

Affected packages

Ubuntu:Pro:14.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-4ubuntu3+esm1

Affected versions

1.*

1.2.17-3ubuntu1

1.2.17-4ubuntu1

1.2.17-4ubuntu2

1.2.17-4ubuntu3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.17-4ubuntu3+esm1",
            "binary_name": "liblog4j1.2-java"
        },
        {
            "binary_version": "1.2.17-4ubuntu3+esm1",
            "binary_name": "liblog4j1.2-java-doc"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-7ubuntu1+esm1

Affected versions

1.*

1.2.17-6ubuntu1

1.2.17-7ubuntu1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.17-7ubuntu1+esm1",
            "binary_name": "liblog4j1.2-java"
        },
        {
            "binary_version": "1.2.17-7ubuntu1+esm1",
            "binary_name": "liblog4j1.2-java-doc"
        }
    ]
}

Ubuntu:18.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-8+deb10u1ubuntu0.1

Affected versions

1.*

1.2.17-7ubuntu2

1.2.17-8

1.2.17-8+deb10u1build0.18.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.17-8+deb10u1ubuntu0.1",
            "binary_name": "liblog4j1.2-java"
        },
        {
            "binary_version": "1.2.17-8+deb10u1ubuntu0.1",
            "binary_name": "liblog4j1.2-java-doc"
        }
    ]
}

Ubuntu:20.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-9ubuntu0.1

Affected versions

1.*

1.2.17-8

1.2.17-9

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.17-9ubuntu0.1",
            "binary_name": "liblog4j1.2-java"
        },
        {
            "binary_version": "1.2.17-9ubuntu0.1",
            "binary_name": "liblog4j1.2-java-doc"
        }
    ]
}

Ubuntu:22.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-11

Affected versions

1.*

1.2.17-10

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.17-11",
            "binary_name": "liblog4j1.2-java"
        },
        {
            "binary_version": "1.2.17-11",
            "binary_name": "liblog4j1.2-java-doc"
        }
    ]
}

Ubuntu:24.10 / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.17-11

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/ubuntu/apache-log4j1.2?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.17-11

Ecosystem specific

{
    "ubuntu_priority": "medium"
}