JBoss Enterprise Application Platform 7.4 for RHEL 7 update for log4j

Published: 2022-04-11 | Updated: 2023-05-07

Risk	Critical
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2021-44832 CVE-2021-45046 CVE-2021-45105 CVE-2021-4104 CVE-2022-23307 CVE-2020-9493 CVE-2022-23302 CVE-2022-23305 CVE-2021-44228
CWE-ID	CWE-94 CWE-835 CWE-502 CWE-89
Exploitation vector	Network
Public exploit	Vulnerability #2 is being exploited in the wild. Public exploit code for vulnerability #3 is available. Vulnerability #8 is being exploited in the wild.
Vulnerable software Subscribe	eap7-undertow (Red Hat package) Operating systems & Components / Operating system package or component eap7-yasson (Red Hat package) Operating systems & Components / Operating system package or component eap7-xom (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly-openssl-el7 (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly-openssl (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly-elytron (Red Hat package) Operating systems & Components / Operating system package or component eap7-wildfly (Red Hat package) Operating systems & Components / Operating system package or component eap7-objectweb-asm (Red Hat package) Operating systems & Components / Operating system package or component eap7-narayana (Red Hat package) Operating systems & Components / Operating system package or component eap7-log4j (Red Hat package) Operating systems & Components / Operating system package or component eap7-jbossws-cxf (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-xnio-base (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-vfs (Red Hat package) Operating systems & Components / Operating system package or component eap7-jboss-server-migration (Red Hat package) Operating systems & Components / Operating system package or component eap7-infinispan (Red Hat package) Operating systems & Components / Operating system package or component eap7-hibernate (Red Hat package) Operating systems & Components / Operating system package or component eap7-hal-console (Red Hat package) Operating systems & Components / Operating system package or component eap7-ecj (Red Hat package) Operating systems & Components / Operating system package or component eap7-activemq-artemis (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Code Injection

EUVDB-ID: #VU59098

Risk: Medium

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-44832

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote user with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

eap7-undertow (Red Hat package): 2.0.41-2.SP2_redhat_00001.1.el7eap

eap7-yasson (Red Hat package): before 1.0.10-1.redhat_00001.1.el7eap

eap7-xom (Red Hat package): before 1.3.7-1.redhat_00001.1.el7eap

eap7-wildfly-openssl-el7 (Red Hat package): before x86_64-2.2.0-2.Final_redhat_00002.1.el7eap

eap7-wildfly-openssl (Red Hat package): before 2.2.0-3.Final_redhat_00002.1.el7eap

eap7-wildfly-elytron (Red Hat package): before 1.15.11-1.Final_redhat_00002.1.el7eap

eap7-wildfly (Red Hat package): before 7.4.4-3.GA_redhat_00011.1.el7eap

eap7-objectweb-asm (Red Hat package): before 9.1.0-1.redhat_00002.1.el7eap

eap7-narayana (Red Hat package): before 5.11.4-1.Final_redhat_00001.1.el7eap

eap7-log4j (Red Hat package): before 2.17.1-1.redhat_00001.1.el7eap

eap7-jbossws-cxf (Red Hat package): before 5.4.4-1.Final_redhat_00001.1.el7eap

eap7-jboss-xnio-base (Red Hat package): before 3.8.6-1.Final_redhat_00001.1.el7eap

eap7-jboss-vfs (Red Hat package): before 3.2.16-1.Final_redhat_00001.1.el7eap

eap7-jboss-server-migration (Red Hat package): before 1.10.0-15.Final_redhat_00014.1.el7eap

eap7-infinispan (Red Hat package): before 11.0.15-1.Final_redhat_00001.1.el7eap

eap7-hibernate (Red Hat package): before 5.3.25-1.Final_redhat_00002.1.el7eap

eap7-hal-console (Red Hat package): before 3.3.9-1.Final_redhat_00001.1.el7eap

eap7-ecj (Red Hat package): before 3.26.0-1.redhat_00002.1.el7eap

eap7-activemq-artemis (Red Hat package): before 2.16.0-7.redhat_00034.1.el7eap

External links

http://access.redhat.com/errata/RHSA-2022:1296

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU58976

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-45046

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incomplete patch in Apache Log4j 2.15.0 for a code injection vulnerability #VU58816 (CVE-2021-44228) in certain non-default configurations. A remote attacker with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can pass malicious data using a JNDI Lookup pattern and perform a denial of service (DoS) attack, exfiltrate data or execute arbitrary code.

Later discovery demonstrates a remote code execution on macOS but no other tested environments.