CVE-2021-44832 | Severity.io

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Related CPE's

a

apache

log4j

9

a

oracle

communications_diameter_signaling_router

2

a

oracle

communications_interactive_session_recorder

4

a

oracle

primavera_gateway

10

a

oracle

primavera_p6_enterprise_project_portfolio_management

6

a

oracle

primavera_unifier

8

retail_assortment_planning

Vulnerable

retail_fiscal_management

Vulnerable

a

oracle

siebel_ui_framework

2

a

oracle

weblogic_server

6

Vulnerable

o

fedoraproject

fedora

2

Vulnerable

a

oracle

communications_brm_-_elastic_charging_engine

2

a

oracle

communications_offline_mediation_controller

2

flexcube_private_banking

Vulnerable

a

oracle

health_sciences_data_management_workbench

3

policy_automation

Vulnerable

policy_automation_for_mobile_devices

Vulnerable

product_lifecycle_analytics

Vulnerable

a

oracle

retail_order_broker

2

a

oracle

retail_xstore_point_of_service

5

References

http://www.openwall.com/lists/oss-security/2021/12/28/1

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf

Third Party Advisory

https://issues.apache.org/jira/browse/LOG4J2-3293

Issue TrackingPatchVendor Advisory

https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143

Mailing ListVendor Advisory

https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/

https://security.netapp.com/advisory/ntap-20220104-0001/

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

PatchThird Party Advisory

Weaknesses

[email protected]

Primary

CWE-20

[email protected]

Secondary

CWE-20CWE-74

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

6.6 · Medium

CVSS V3.1
CVSS V3.0
CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-12-28T20:15:08.400

3 years ago

Last modified

2023-11-07T03:39:43.957

1 year ago