SQL injection in Apache Log4j - CVE-2022-23305

Vulnerability identifier: #VU59691

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23305

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the JDBCAppender. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Note, a non-default configuration with enabled JDBCAppender is required to exploit the vulnerability.

Apache Log4j
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
openEuler
Crypto Hardware Initialization and Maintenance (CHIM)
IBM Telco Network Cloud Manager - Performance (TNCP)
IBM Cloud Pak for Data System
IBM Cloud Pak for Multicloud Management Monitoring
Spectrum Discover
Oracle Communications EAGLE FTP Table Base Retrieval
IBM Sterling Connect:Direct Web Services
JBoss A-MQ
Oracle Communications Network Integrity
Oracle Communications Unified Inventory Management
Oracle Healthcare Data Repository
Oracle Identity Manager Connector
Infrastructure Technology
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
Oracle Identity Management Suite
Oracle E-Business Suite Information Discovery
Enterprise Manager Base Platform
Splunk AppDynamics Database Agent
Log Analysis
Netcool Operations Insight
IBM Security Access Manager for Enterprise Single-Sign On
Oracle E-Business Suite Cloud Manager and Cloud Backup Module
Security Director Insights
IBM Integrated Analytics System
IBM Db2 Web Query for i
Oracle Utilities Application Framework
Cloudera Data Platform Private Cloud Base for IBM
Oracle Business Process Management Suite
Application Management Pack for E-Business Suite
Red Hat Software Collections
Oracle JDeveloper
log4j (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
eap7-hibernate (Red Hat package)
tomcat7 (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat8 (Red Hat package)
liblog4j1.2-java (Ubuntu package)
eap7-jboss-annotations (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
parfait-javadoc
parfait
parfait-examples
pcp-parfait-agent
eap7-yasson (Red Hat package)
log4j-jboss-logmanager (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
log4j-manual
log4j
log4j-eap6 (Red Hat package)
apache-log4j1.2 (Ubuntu package)
log4j12
log4j12-javadoc
log4j12-manual
log4j-javadoc
rh-maven36-log4j12 (Red Hat package)
log4j12-help
eap7-xom (Red Hat package)
eap7-h2database (Red Hat package)
eap7-avro (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-wildfly-openssl (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-log4j (Red Hat package)
eap7-jboss-vfs (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
snmp4j (Red Hat package)
eap7-ecj (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)
AMQ Streams
Fuse
JBoss Enterprise Application Platform
IBM WebSphere Application Server
Oracle Coherence
Oracle WebLogic Server
IBM WebSphere Application Server Liberty
IBM Cloud Pak for Multicloud Management
Oracle Financial Services Revenue Management and Billing
IBM Content Navigator
JBoss Web Server
Red Hat Virtualization Manager
RecoverPoint Classic
Oracle Agile Engineering Data Management
Oracle Business Intelligence Enterprise Edition
Cúram Social Program Management (SPM)
IBM OpenPages with Watson
Datacap
Oracle Advanced Supply Chain Planning
Oracle Tuxedo
Oracle Application Testing Suite
DevOps
IBM Sterling Order Management
JBoss Data Virtualization
JBoss Data Grid
IBM Qradar SIEM
IBM Cognos Controller
Red Hat Single Sign-On
MySQL Enterprise Monitor
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
Oracle WebCenter Content
Oracle Retail Extract Transform and Load
Oracle Retail Fiscal Management
IBM Cloud Pak System

The vulnerability is resolved in Apache Log4j 2.x branch.

log4j (Red Hat package) - addressed in versions 1.2.17-17.el7_3, 1.2.17-18.el7_4
AMQ Streams - addressed in versions 1.6.7, 2.0.1
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.11-1.Final_redhat_00002.1.el7eap, 1.15.11-1.Final_redhat_00002.1.el8eap
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
Spectrum Discover - update to 2.0.4.5
eap7-undertow (Red Hat package) - addressed in versions 2.2.16-1.Final_redhat_00001.1.el7eap, 2.2.16-1.Final_redhat_00001.1.el8eap
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008 LA2, 3.2.0 IF004
JBoss Web Server - update to 3.1.14
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.7.13-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el8eap
ovirt-engine (Red Hat package) - update to 4.4.10.6-0.1.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.4.10-1.el8ev
RecoverPoint Classic - update to 5.1 SP4 P4
eap7-hibernate (Red Hat package) - addressed in versions 5.3.25-1.Final_redhat_00002.1.el7eap, 5.3.25-1.Final_redhat_00002.1.el8eap
JBoss A-MQ - update to 6.3.20
Fuse - addressed in versions 6.3.20, 7.10.1
JBoss Data Virtualization - addressed in versions 6.4.8.SP1, 6.4.8 SP2
JBoss Enterprise Application Platform - addressed in versions 7.3.11, 7.4.4
tomcat7 (Red Hat package) - update to 7.0.70-46.ep7.el7
JBoss Data Grid - update to 7.3.9
Red Hat Single Sign-On - addressed in versions 7.4.10, 7.5.1
eap7-wildfly (Red Hat package) - addressed in versions 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el8eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF01
tomcat8 (Red Hat package) - update to 8.0.36-49.ep7.el7
IBM OpenPages with Watson - addressed in versions 8.1.0.2.3, 8.2.0.4, 8.2.0.4.6
Datacap - update to 9.1.10
Infrastructure Technology - update to 11.2.8.0
Oracle Communications Offline Mediation Controller - update to 12.0.0.5.1
IBM WebSphere Application Server Liberty - update to 22.0.0.1
Splunk AppDynamics Database Agent - update to 26.1.0
liblog4j1.2-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.17-8+deb10u1ubuntu0.2, 1.2.17-9ubuntu0.2
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el8eap
parfait-javadoc - update to 0.5.4-4
parfait - update to 0.5.4-4
parfait-examples - update to 0.5.4-4
pcp-parfait-agent - update to 0.5.4-4
eap7-yasson (Red Hat package) - addressed in versions 1.0.10-1.redhat_00001.1.el7eap, 1.0.10-1.redhat_00001.1.el8eap
log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.1.4-3.Final_redhat_00002.1.ep6.el6, 1.1.4-3.Final_redhat_00002.1.ep6.el7
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.2.2-1.Final_redhat_00002.1.el7eap, 1.2.2-1.Final_redhat_00002.1.el8eap, 1.2.2-2.Final_redhat_00002.1.el7eap
log4j-manual - addressed in versions 1.2.15-126.9.1, 1.2.17-5.9.1
log4j - addressed in versions 1.2.15-126.9.1, 1.2.17-5.9.1
log4j-eap6 (Red Hat package) - addressed in versions 1.2.17-3.redhat_00008.1.ep6.el6, 1.2.17-3.redhat_00008.1.ep6.el7
apache-log4j1.2 (Ubuntu package) - update to 1.2.17-4ubuntu3+esm2
log4j12 - update to 1.2.17-4.9.1
log4j12-javadoc - update to 1.2.17-4.9.1
log4j12-manual - update to 1.2.17-4.9.1
log4j - update to 1.2.17-16.14
log4j - update to 1.2.17-18
log4j-javadoc - update to 1.2.17-18
log4j-manual - update to 1.2.17-18
rh-maven36-log4j12 (Red Hat package) - update to 1.2.17-23.4.el7
log4j12-help - update to 1.2.17-25
log4j12 - update to 1.2.17-25
eap7-xom (Red Hat package) - addressed in versions 1.3.7-1.redhat_00001.1.el7eap, 1.3.7-1.redhat_00001.1.el8eap
Log Analysis - update to 1.3.7.2
eap7-h2database (Red Hat package) - update to 1.4.197-3.redhat_00004.1.el7eap
Netcool Operations Insight - update to 1.6.7
eap7-avro (Red Hat package) - update to 1.7.6-8.redhat_00003.1.el7eap
eap7-jboss-marshalling (Red Hat package) - update to 2.0.15-1.Final_redhat_00001.1.el7eap
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.0-3.Final_redhat_00002.1.el7eap, 2.2.0-3.Final_redhat_00002.1.el8eap
eap7-xml-security (Red Hat package) - update to 2.2.3-2.redhat_00001.1.el7eap
eap7-wss4j (Red Hat package) - update to 2.3.3-2.redhat_00001.1.el7eap
IBM Cloud Pak System - update to 2.3.3.4
eap7-xalan-j2 (Red Hat package) - update to 2.7.1-38.redhat_00015.1.el7eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-7.redhat_00034.1.el7eap, 2.16.0-7.redhat_00034.1.el8eap
eap7-log4j (Red Hat package) - addressed in versions 2.17.1-1.redhat_00001.1.el7eap, 2.17.1-1.redhat_00001.1.el8eap
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.16-1.Final_redhat_00001.1.el7eap, 3.2.16-1.Final_redhat_00001.1.el8eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.9-1.Final_redhat_00001.1.el7eap, 3.3.9-1.Final_redhat_00001.1.el8eap
eap7-apache-cxf (Red Hat package) - update to 3.4.10-1.SP1_redhat_00001.1.el7eap
snmp4j (Red Hat package) - update to 3.6.4-0.1.el8ev
eap7-ecj (Red Hat package) - addressed in versions 3.26.0-1.redhat_00002.1.el7eap, 3.26.0-1.redhat_00002.1.el8eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.4-1.Final_redhat_00001.1.el7eap, 5.4.4-1.Final_redhat_00001.1.el8eap
eap7-narayana (Red Hat package) - addressed in versions 5.11.4-1.Final_redhat_00001.1.el7eap, 5.11.4-1.Final_redhat_00001.1.el8eap
DevOps - update to 7.0.0.2
IBM Security Access Manager for Enterprise Single-Sign On - update to 8.2.2 Fix Pack 15
eap7-objectweb-asm (Red Hat package) - addressed in versions 9.1.0-1.redhat_00002.1.el7eap, 9.1.0-1.redhat_00002.1.el8eap
IBM Sterling Order Management - update to 10.0.2403.1
eap7-infinispan (Red Hat package) - addressed in versions 11.0.15-1.Final_redhat_00001.1.el7eap, 11.0.15-1.Final_redhat_00001.1.el8eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.4-1.redhat_00003.1.el7sso, 15.0.4-1.redhat_00003.1.el8sso
Oracle E-Business Suite Cloud Manager and Cloud Backup Module - update to 22.1.1.1
Security Director Insights - update to 23.1R1

• https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y
• https://logging.apache.org/log4j/1.2/index.html

• Multiple vulnerabilities in Apache Log4j
• Red Hat Enterprise Linux 8.4 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8.2 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8.1 update for the parfait:0.5 module
• Multiple vulnerabilities in IBM Db2 Web Query for i
• Multiple vulnerabilities in Red Hat Data Grid
• Red Hat Software Collections update for rh-maven36-log4j12
• Red Hat JBoss Enterprise Application Platform 7.4 update for Apache Log4j
• Red Hat JBoss Enterprise Application Platform 6.4 update for Apache Log4j
• CentOS 7 update for log4j
• Red Hat Single Sign-On update for Apache Log4j
• Multiple vulnerabilities in Red Hat Single Sign-On 7.5 for Red Hat Enterprise Linux 8
• Multiple vulnerabilities in Red Hat Single Sign-On for Red Hat Enterprise Linux 7
• Multiple vulnerabilities in Red Hat Single Sign-On
• Red Hat Enterprise Linux Server 7 update for log4j
• Multiple vulnerabilities in Red Hat AMQ Streams 1.6
• Multiple vulnerabilities in Red Hat AMQ Streams 2.0
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat JBoss Web Server 3.1
• Multiple vulnerabilities in Red Hat JBoss Fuse and A-MQ
• IBM Sterling Connect:Direct Web Services update for Apache Log4j
• Multiple vulnerabilities in IBM WebSphere Application Server
• Multiple vulnerabilities in Red Hat Fuse 7.10
• IBM Cloud Pak for Data System 1.0 update for Apache Log4j
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base for IBM
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• JBoss Enterprise Application Platform 7.4 for RHEL 8 update for log4j
• JBoss Enterprise Application Platform 7.4 for RHEL 7 update for log4j
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle Communications EAGLE FTP Table Base Retrieval
• SQL injection in Oracle Financial Services Revenue Management and Billing
• Multiple vulnerabilities in Oracle WebLogic Server
• SQL injection in Oracle Tuxedo
• SQL injection in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle JDeveloper
• Multiple vulnerabilities in Oracle Identity Manager Connector
• Multiple vulnerabilities in Oracle Identity Management Suite
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Healthcare Data Repository
• Multiple vulnerabilities in Hyperion Infrastructure Technology
• Multiple vulnerabilities in Hyperion Data Relationship Management
• SQL injection in Oracle Advanced Supply Chain Planning
• SQL injection in Oracle E-Business Suite Cloud Manager and Cloud Backup Module
• Multiple vulnerabilities in IBM Telco Network Cloud Manager - Performance
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Cloud Pak System
• SQL injection in IBM OpenPages with Watson
• Multiple vulnerabilities in Oracle Communications Offline Mediation Controller
• SQL injection in Oracle Communications Instant Messaging Server
• SQL injection in Oracle E-Business Suite Information Discovery
• SQL injection in Oracle Retail Extract Transform and Load
• SQL injection in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM Spectrum Discover
• SQL injection in Application Management Pack for E-Business Suite
• SQL injection in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in Oracle Retail Fiscal Management
• SQL injection in Oracle WebCenter Content
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• SQL injection in IBM Integrated Analytics System
• Multiple vulnerabilities in Oracle Coherence
• SUSE update for log4j
• SUSE update for log4j
• SUSE update for log4j12
• Ubuntu update for apache-log4j1.2
• Amazon Linux AMI update for log4j
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in IBM Security Access Manager for Enterprise Single Sign-On
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Networks Security Director Insights
• Gentoo update for Apache Log4j
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler update for log4j12
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM DevOps Release
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Anolis OS update for parfait:0.5 module
• Anolis OS update for log4j
• Ubuntu update for apache-log4j1.2
• Multiple vulnerabilities in Crypto Hardware Initialization and Maintenance (CHIM) as shipped with IBM Common Cryptographic Architecture (CCA)
• Multiple vulnerabilities in IBM Cúram Social Program Management (SPM)
• Multiple vulnerabilities in IBM Datacap
• Multiple vulnerabilities in Oracle Application Testing Suite
• Splunk AppDynamics Database Agent update for third-party components
• Multiple vulnerabilities in IBM Content Navigator