NetSight
IP …
medium6.6

CVE-2021-44832

Improper Input Validation and Injection in Apache Log4j2

Impact

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.logging.log4j:log4j-core>= 2.0-beta7, < 2.3.22.3.2
mavenorg.ops4j.pax.logging:pax-logging-log4j2>= 1.8.0, < 1.9.21.9.2

Affected products

VendorProductAffected versions
ApacheLog4j
from 2.0.1 before 2.3.2
from 2.4 before 2.12.4
from 2.13.0 before 2.17.1
Version 2.0
OracleCommunications Diameter Signaling Router
from 8.0.0.0 through 8.5.1.0
from 8.3.0.0 through 8.5.1.0
OracleCommunications Interactive Session Recorder
Versions 6.3, 6.4
OraclePrimavera Gateway
from 17.12.0 through 17.12.11
from 18.8.0 through 18.8.13
from 19.12.0 through 19.12.12
from 20.12.0 through 20.12.7
Version 21.12.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 19.12.0 through 19.12.18.0
from 20.12.0.0 through 20.12.12.0
from 19.12.0.0 through 19.12.18.0
Version 21.12.0.0
OraclePrimavera Unifier
Versions 18.8, 19.12, 20.12, 21.12
OracleRetail Assortment Planning
Version 16.0.3
OracleRetail Fiscal Management
Version 14.2
OracleSiebel Ui Framework
through 21.12
Version 21.12
OracleWeblogic Server
Versions 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CiscoCloudcenter
Version 4.10.0.16
FedoraprojectFedora
Versions 34, 35

Weakness classification

CWE-20CWE-74

References