Skip to content
Fencer Vulns
high 7.5

CVE-2021-4104 in the critical feed json

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

published 2021-12-14 4 y ago modified 2026-06-17 4 mo ago also GHSA-fp5r-v3w9-4333 , EUVD-2021-2514

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
80.6%
EPSS 80.6% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Patch / fix

  • oracle communications_offline_mediation_controller 12.0.0.4.0
  • oracle hyperion_data_relationship_management 11.2.8.0
  • oracle hyperion_infrastructure_technology 11.2.8.0
  • apache-log4j1.2 Debian 14, Debian 13, Debian 12 1.2.17-11

debian advisories DEBIAN-CVE-2021-4104

  • apache-log4j1.2 Ubuntu 18.04 LTS 1.2.17-8+deb10u1ubuntu0.1
  • apache-log4j1.2 Ubuntu 20.04 LTS 1.2.17-9ubuntu0.1
  • apache-log4j1.2 Ubuntu Pro 14.04 LTS 1.2.17-4ubuntu3+esm1
  • apache-log4j1.2 Ubuntu Pro 16.04 LTS 1.2.17-7ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2021-4104

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • uom-se RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896
  • si-units RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.6.5-2.module+el8+2463+615f6896
  • unit-api RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0-5.module+el8+2463+615f6896
  • uom-parent RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.3-3.module+el8+2463+615f6896
  • uom-systems RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.7-1.module+el8+2463+615f6896
  • uom-se-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896

red hat advisories RHSA-2024:10207RHSA-2022:0289RHSA-2022:0291RHSA-2022:0294RHSA-2022:0290RHSA-2022:1296

  • kafka OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.10.2.2-5.12.1
  • spark OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.6.3-8.12.1
  • storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.11.2
  • logstash OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.1-5.10.1
  • zookeeper OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.4.10-3.15.1
  • elasticsearch OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.2-5.6.1
  • venv-openstack-aodh OpenStack Cloud 8, HPE Helion OpenStack 8 5.1.1~dev7-12.40.1
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.43.1

suse advisories SUSE-SU-2022:0355-1SUSE-SU-2022:0354-1SUSE-SU-2022:0133-1SUSE-SU-2022:0126-1SUSE-SU-2021:4190-1SUSE-SU-2021:4160-1

  • log4j openSUSE Tumbleweed 2.16.0-2.1
  • kafka-kit openSUSE Tumbleweed 2.1.0-2.1
  • kafka Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • kafka-kit Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • kafka Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.3.1
  • kafka-kit Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.3.1
  • log4j12 openSUSE Leap 15.2 1.2.17-lp152.3.3.2
  • log4j12-mini openSUSE Leap 15.2 1.2.17-lp152.3.3.2

opensuse advisories openSUSE-SU-2024:11681-1openSUSE-SU-2024:11696-1openSUSE-SU-2022:0038-1openSUSE-SU-2021:1631-1openSUSE-SU-2021:1612-1openSUSE-SU-2021:4112-1

  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+235+62ea7738
  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+2610+de2b8c0b
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+235+62ea7738
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+2610+de2b8c0b

almalinux advisories ALSA-2022:0290

  • uom-se Rocky Linux 8 1.0.4-3.module+el8.3.0+214+edf13b3f
  • parfait Rocky Linux 8 0.5.4-4.module+el8.5.0+728+553fbdb8
  • uom-lib Rocky Linux 8 1.0.1-6.module+el8.3.0+214+edf13b3f
  • si-units Rocky Linux 8 0.6.5-2.module+el8.3.0+214+edf13b3f
  • unit-api Rocky Linux 8 1.0-5.module+el8.3.0+214+edf13b3f
  • uom-parent Rocky Linux 8 1.0.3-3.module+el8.3.0+214+edf13b3f
  • uom-systems Rocky Linux 8 0.7-1.module+el8.3.0+214+edf13b3f

rocky linux advisories RLSA-2022:0290

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-4104 updated cvss 7.5

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender

  • Red Hat A-MQ Clients 2 log4j Red Hat AMQ Broker 7 log4j
    affected: workaround, no fix available
  • Red Hat JBoss Fuse Service Works 6 log4j Red Hat JBoss Operations Network 3 log4j Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat streams for Apache Kafka log4j
    affected: workaround, no fix available
  • Red Hat EAP 6.4 log4j async
    fixed: vendor fix RHSA-2022:0437
  • Red Hat EAP 6.4.24 release
    fixed: vendor fix RHSA-2022:5458
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8 7.4-45, rh-sso-7/sso75-openshift-rhel8 7.5-17, rh-sso-7/sso7-rhel8-operator-bundle 7.5.1-9, rh-sso-7/sso74-openj9-openshift-rhel8 7.4-60
    fixed: vendor fix RHSA-2022:0450
  • Red Hat Data Grid 7.3.9
    fixed: vendor fix RHSA-2022:0430
  • Red Hat Enterprise Linux AppStream (v. 8) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0290
show 5 more
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0294
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0291
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0289
  • Red Hat Enterprise Linux Client (v. 7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Client Optional (v. 7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server (v. 6 ELS) log4j 1.2.14-6.5.el6_10 Red Hat Enterprise Linux Server (v. 7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.3) log4j 1.2.17-16.el7_3
    +19 more products
    Red Hat Enterprise Linux Server AUS (v. 7.4) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.6) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.6) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-manual 1.2.14-6.5.el6_10, log4j-javadoc 1.2.14-6.5.el6_10 Red Hat Enterprise Linux Server Optional (v. 7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-manual 1.2.17-16.el7_3, log4j-javadoc 1.2.17-16.el7_3 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.6) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Workstation (v. 7) log4j 1.2.17-17.el7_4 Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-manual 1.2.17-17.el7_4, log4j-javadoc 1.2.17-17.el7_4
    fixed: vendor fix RHSA-2021:5206
  • Red Hat Fuse 7.10.1
    fixed: vendor fix RHSA-2022:0661

22 more fixed, 19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Ransomware

Groups reported to have exploited it in intrusions.

  • Prophet Spider initial access broker

reported by secureworks.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

80.60% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven log4j:log4j
>=1.2.0, <=1.2.17
 no fix listed
maven org.zenframework.z8.dependencies.commons:log4j-1.2.17
<=2.0
 no fix listed

Affected products

  • Apache Software Foundation Apache Log4j 1.x

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.