Code Injection in Apache Log4j - CVE-2021-44832

Vulnerability identifier: #VU59098

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2021-44832

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Apache Log4j
Enhanced Interactive Unified Mediation (eIUM)
UIoT
Spectator
Unified Data Management (UDM)
Authentication Server Function (AUSF)
Unstructured Data Storage Function (UDSF)
User Data Repository (UDR)
Oracle Banking Platform
dgs-framework
Oracle Utilities Framework
Oracle Healthcare Master Person Index
RecoverPoint Classic
Java agent
Oracle Communications Network Charging and Control
Oracle Agile Engineering Data Management
Oracle Communications ASAP
Oracle FLEXCUBE Universal Banking
Oracle FLEXCUBE Private Banking
Oracle Policy Automation
Oracle Data Integrator
Oracle Communications User Data Repository
Oracle Retail Store Inventory Management
Oracle Retail Service Backbone
Oracle Retail Customer Insights
Oracle Retail Xstore Point of Service
Oracle Retail Order Broker
3PAR Service Processors
webMethods BPM
Fraud Risk Management (FRM)
Silver Peak Orchestrator
API Gateway
AMQ Streams
Karaf
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Fuse
IBM WebSphere Application Server
Oracle WebLogic Server
Primavera Gateway
API Manager
Oracle Health Sciences InForm
Cloudera Data Platform Private Cloud Base for IBM
Oracle Hospitality Gift and Loyalty
Oracle Managed File Transfer
Oracle WebCenter Sites
Oracle Retail Price Management
Oracle Retail Data Extractor for Merchandising
Oracle Communications Element Manager
Oracle Communications Session Route Manager
IBM Telco Network Cloud Manager - Performance (TNCP)
IBM Netcool Agile Service Manager
IBM Operations Analytics Predictive Insights
Log Analysis
Management Cloud Engine
Oracle Communications Cloud Native Core Network Repository Function
IBM Spectrum Copy Data Management
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Conductor
Oracle Health Sciences Data Management Workbench
IBM Security Guardium Key Lifecycle Manager (GKLM)
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
Oracle Banking Loans Servicing
Oracle Banking Deposits and Lines of Credit Servicing
IBM Sterling Secure Proxy
Oracle Product Lifecycle Analytics
IBM Sterling Connect:Direct for UNIX
Oracle Communications EAGLE FTP Table Base Retrieval
OpenShift Logging
IBM Sterling External Authentication Server
Red Hat Integration Camel-K
IBM Sterling Control Center
IBM Tivoli Monitoring
Oracle Enterprise Command Center Framework
Oracle E-Business Suite Information Discovery
IBM Spectrum Symphony
Oracle Communications WebRTC Session Controller
Oracle Communications Network Integrity
Oracle Communications IP Service Activator
Oracle Communications Unified Inventory Management
Oracle Financial Services Model Management and Governance
Netcool/OMNIbus
Oracle Healthcare Data Repository
Oracle Communications Diameter Signaling Router
Oracle Identity Manager Connector
Oracle Health Sciences Empirica Signal
IBM Spectrum Protect Plus
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
RSA RT
Oracle Communications Performance Intelligence Center (PIC) Software
Infrastructure Technology
Oracle Identity Management Suite
Enterprise Manager Base Platform
Oracle Banking Treasury Management
Oracle Banking Trade Finance
Oracle Payment Interface
Oracle Hospitality Token Proxy Service
Dell EMC Data Protection Search
Primavera P6 Enterprise Project Portfolio Management
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications EAGLE Element Management System
Operations Dashboard
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
Dell EMC Unisphere Central
IBM Cloud Application Performance Management (APM)
Oracle Communications Session Report Manager
Hyperion Financial Management
Hyperion Profitability and Cost Management
Security Director Insights
Oracle Insurance Data Gateway
Oracle Communications Convergence
Oracle Communications Interactive Session Recorder
Oracle Communications MetaSolv Solution
Oracle Communications Services Gatekeeper
Oracle Communications Instant Messaging Server
Oracle Hyperion BI+
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
thrift-glib
libthrift-java
perl-thrift
python3-thrift
thrift-debugsource
thrift-devel
thrift-qt
thrift
wildfly-elytron
wildfly-elytron-javadoc
eap7-yasson (Red Hat package)
wildfly-common-help
wildfly-common
wildfly-security-manager
wildfly-security-manager-javadoc
wildfly-server-provisioning-maven-plugin
wildfly-build-tools
wildfly-build-tools-javadoc
wildfly-feature-pack-build-maven-plugin
wildfly-server-provisioning
wildfly-server-provisioning-standalone
eap7-xom (Red Hat package)
avalon-logkit
avalon-logkit-help
eap7-wildfly-openssl (Red Hat package)
wildfly-core
wildfly-core-javadoc
wildfly-core-feature-pack
HikariCP-help
HikariCP
jenkins-json-lib
json-lib-help
json-lib
liblog4j2-java (Ubuntu package)
eap7-activemq-artemis (Red Hat package)
log4j-jcl
log4j-bom
log4j-jmx-gui
log4j-web
log4j-slf4j
log4j-taglib
log4j-help
log4j
eap7-log4j (Red Hat package)
mx4j
mx4j-javadoc
mx4j-manual
metrics-annotation
metrics
metrics-servlet
metrics-parent
metrics-servlets
metrics-benchmarks
metrics-doc
metrics-ehcache
metrics-ganglia
metrics-graphite
metrics-httpasyncclient
metrics-logback
metrics-log4j2
metrics-log4j
metrics-jvm
metrics-json
metrics-jersey2
metrics-jdbi
metrics-healthchecks
metrics-httpclient
metrics-javadoc
datanucleus-api-jdo-javadoc
mybatis
datanucleus-api-jdo
mybatis-javadoc
datanucleus-rdbms-javadoc
datanucleus-rdbms
datanucleus-core-javadoc
datanucleus-core
eap7-jboss-vfs (Red Hat package)
springframework-help
springframework-aop
springframework-expression
springframework-instrument
springframework-context
springframework-web
springframework-tx
springframework-oxm
springframework-orm-hibernate4
springframework-orm
springframework-jms
springframework-jdbc
springframework-beans
springframework
jboss-logging
jboss-logging-javadoc
eap7-hal-console (Red Hat package)
jgroups
jgroups-help
eap7-ecj (Red Hat package)
netty-help
netty
avalon-framework-help
avalon-framework
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
infinispan-help
infinispan
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
IBM App Connect for Manufacturing
Red Hat OpenShift Container Platform
Enterprise Manager for Peoplesoft
Primavera Unifier
Oracle Autovue for Agile Product Lifecycle Management
Apache Struts
Siebel UI Framework
EMC Integrated Data Protection Appliance
Zoho ManageEngine EventLog Analyzer
Oracle Health Sciences Information Manager
Oracle Agile PLM MCAD Connector
Oracle Insurance Insbridge Rating and Underwriting
IBM Qradar SIEM
Event Streams
IBM Cognos Controller
JBoss Data Grid
Oracle Hyperion Tax Provision
Solaris Cluster
Ubuntu
openEuler
Fedora
Oracle Healthcare Translational Research
Oracle Communications Convergent Charging Controller
Oracle Healthcare Foundation
Oracle Hospitality Suite8
Oracle Hospitality Labor Management
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Demantra Demand Management
Instantis EnterpriseTrack
Siebel Apps - Marketing
Hyperion Planning
Oracle Taleo Platform
SecureTransport
Oracle Communications Order and Service Management
MySQL Enterprise Monitor
IBM DB2
Oracle Communications BRM - Elastic Charging Engine
Oracle Essbase
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle Hospitality Reporting and Analytics
Oracle Agile PLM Framework
Ghidra
IBM App Connect Enterprise
EntireX
Oracle JDeveloper
Oracle SQL Developer
Oracle Policy Automation for Mobile Devices
Oracle Enterprise Manager Ops Center
Oracle Retail Integration Bus
Oracle Retail Fiscal Management
Oracle Banking Payments
Oracle Retail Invoice Matching
Oracle Retail Assortment Planning
Oracle Retail Merchandising System
Oracle Retail EFTLink
IntroSpect
HPE StoreServ Management Console
RecoverPoint for VMs

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote user with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.

Install updates from vendor's website.

• https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
• https://issues.apache.org/jira/browse/LOG4J2-3293
• https://logging.apache.org/log4j/2.x/security.html