Deserialization of Untrusted Data in Apache Log4j - CVE-2021-4104

Vulnerability identifier: #VU58977

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2021-4104

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Apache Log4j
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Workstation
CentOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Anolis OS
IBM Security Identity Manager Virtual Appliance
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
HPE Helion Openstack
SUSE OpenStack Cloud
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Ubuntu
openEuler
Crypto Hardware Initialization and Maintenance (CHIM)
NetAtlas Element Management System (EMS)
IBM Security Verify Access
IBM DS8000 Hardware Management Console
Silver Peak Orchestrator
Enhanced Interactive Unified Mediation (eIUM)
RecoverPoint Classic
IBM Security Directory Server
IBM Engineering Systems Design Rhapsody
Datacap
B2B Advanced Communications
Multi-Enterprise Integration Gateway
3PAR Service Processors
Extended Command-Line Interface (XCLI) Utility
Hyper-Scale Manager
DevOps
IBM Engineering Requirements Management DOORS Next
IBM Sterling Order Management
Fraud Risk Management (FRM)
IBM Data Studio Client
IBM Cloud Pak for Multicloud Management
IBM i Access Client Solutions
Red Hat OpenShift Container Platform
DB2 Recovery Expert for LUW
IBM Copy Services Manager
Jazz for Service Management
IBM Operations Analytics Predictive Insights
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Pak for Data System
Spectrum Discover
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Automation Manager
Dell Secure Connect Gateway
IBM Spectrum Control
IBM Global High Availability Mailbox
IBM Tivoli Monitoring
JBoss A-MQ
UCD - IBM UrbanCode Deploy
StoredIQ
WebSphere Service Registry and Repository
IBM Transformation Extender Advanced
IBM Security Verify Governance
Enterprise Manager Base Platform
Log Analysis
Netcool Operations Insight
QRadar User Behavior Analytics
Unified Mediation Bus
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
IBM Security Access Manager for Enterprise Single-Sign On
IBM Common Licensing
Security Director Insights
IBM Tivoli Netcool/OMNIbus Integration – Java Netcool Utility Library
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
eap7-hibernate (Red Hat package)
tomcat7 (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
tomcat8 (Red Hat package)
eap7-jboss-annotations (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
pcp-parfait-agent
parfait-javadoc
parfait-examples
parfait
kafka
eap7-yasson (Red Hat package)
log4j-jboss-logmanager (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
storm
storm-nimbus
storm-supervisor
log4j (Red Hat package)
log4j
log4j-manual
log4j-eap6 (Red Hat package)
log4j12-manual
log4j12-javadoc
log4j12
liblog4j1.2-java (Ubuntu package)
log4j-javadoc
rh-maven36-log4j12 (Red Hat package)
log4j12-help
eap7-xom (Red Hat package)
eap7-h2database (Red Hat package)
spark
eap7-avro (Red Hat package)
dev-embedded/arduino
games-server/minecraft-server
eap7-jboss-marshalling (Red Hat package)
openstack-monasca-thresh
eap7-wildfly-openssl (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
logstash
elasticsearch
venv-openstack-monasca-x86_64
eap7-xalan-j2 (Red Hat package)
openstack-monasca-agent
python-monasca-agent
eap7-activemq-artemis (Red Hat package)
eap7-log4j (Red Hat package)
eap7-jboss-vfs (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
zookeeper-server
snmp4j (Red Hat package)
eap7-ecj (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
net-wireless/unifi
app-backup/tsm
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Db2 Web Query for i
Oracle Utilities Testing Accelerator
IBM Tivoli Application Dependency Discovery Manager
IBM Content Navigator
JBoss Web Server
IBM Integrated Web Server (IWS)
Informix Dynamic Server
IBM Informix Dynamic Server on Cloud Pak for Data
Fuse
JBoss Enterprise Application Platform
IBM Integrated Application Server (IAS)
Oracle WebLogic Server
Red Hat Virtualization Manager
IBM Security Identity Governance and Intelligence (IGI)
Red Hat Single Sign-On
IBM Sterling Global Mailbox (GM)
JBoss Data Virtualization
Oracle Service Bus
IBM Navigator for i
Oracle Communications Order and Service Management
JBoss Data Grid
IBM Qradar SIEM
IBM Cognos Command Center
IBM Cognos Controller
Content Manager Enterprise Edition
IBM DB2
IBM Security Guardium
Oracle Retail Allocation
IBM Cloud Pak System
IntroSpect
HPE StoreServ Management Console
RSA Identity Governance and Lifecycle

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in JMSAppender, when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution.

Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.

Install updates from vendor's website.

• https://access.redhat.com/security/cve/CVE-2021-4104
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126