Improper Input Validation and Injection in Apache Log4j2
Moderate severity
GitHub Reviewed
Published
Jan 4, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
>= 2.0-beta7, < 2.3.2
>= 2.4, < 2.12.4
>= 2.13.0, < 2.17.1
Patched versions
2.3.2
2.12.4
2.17.1
Description
Published by the National Vulnerability Database
Dec 28, 2021
Reviewed
Dec 28, 2021
Published to the GitHub Advisory Database
Jan 4, 2022
Last updated
Jan 27, 2023
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Affected packages
Only the
org.apache.logging.log4j:log4j-corepackage is directly affected by this vulnerability. Theorg.apache.logging.log4j:log4j-apishould be kept at the same version as theorg.apache.logging.log4j:log4j-corepackage to ensure compatability if in use.This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.
References