CVE-2021-44832 Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Attackers can execute arbitrary code if the logging configuration uses a JDBC Appender with a JNDI LDAP data source URI controlled by the attacker.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44832?
CVE-2021-44832 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 28 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Which versions are affected by CVE-2021-44832?
14 open source packages ship an affected version, including org.ops4j.pax.logging:pax-logging-log4j2 and org.apache.logging.log4j:log4j-core. It affects 22 products.
| Package | Affected | Fixed in |
|---|---|---|
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.10.0 | 1.10.9 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.10.0 | 1.10.9 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.11.0 | 1.11.13 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.11.0 | 1.11.13 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.8.0 | 1.9.2 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.8.0 | 1.9.2 |
8 more packages
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.14 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.14 |
org.apache.logging.log4j:log4j-core Maven | From 2.0-beta7 | 2.3.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.0-beta7 | 2.3.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.17.1 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.17.1 |
org.apache.logging.log4j:log4j-core Maven | From 2.4 | 2.12.4 |
org.apache.logging.log4j:log4j-core Maven | From 2.4 | 2.12.4 |
Linux distribution packages (2)
log4j openSUSE:Leap 15.2 | All versions | 2.17.0-lp152.3.15.1 |
log4j openSUSE:Leap 15.3 | All versions | 2.17.0-4.16.1 |
Products include Apache Log4j, Cisco Cloudcenter, Debian Debian Linux, Fedoraproject Fedora, Oracle Communications Brm - Elastic Charging Engine, Oracle Communications Diameter Signaling Router and 16 more.
How do I fix CVE-2021-44832?
Upgrade org.ops4j.pax.logging:pax-logging-log4j2 to a fixed version for your release line: 1.10.9, 1.11.13, 1.9.2 or 2.0.14.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-44832 being exploited?
There is no known exploitation of CVE-2021-44832 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2021-44228 Apache Log4j2 Remote Code Execution
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data
- CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1
- CVE-2017-5645 Deserialization of Untrusted Data in Log4j
- CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
Sources
Also known as DEBIAN-CVE-2021-44832, DLA-2870-1, GHSA-8489-44mv-ggj8, MGASA-2022-0002, MINI-3mq3-9fgj-6rpv, OESA-2021-1481 and 5 more.