Skip to content
Fencer Vulns
critical 10.0

GHSA-3qpm-h9ch-px3c json

Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library

published 2022-01-06 4 y ago modified 2024-12-04 23 mo ago

cvss
10.0
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser. It's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).

### Impact Malicious client code could be used to send messages and cause remote code execution on the server.

### Patches PowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`. All versions prior to `1.5.2.1` are affected and are not patched.

### Workarounds If you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.

### References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/advisories/GHSA-p6xc-xr62-6r2g

### For more information If you have any questions or comments about this advisory: * Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)

Patch / fix

  • maven org.powernukkit:powernukkit 1.5.2.1

CVSS scores

assigned by version score vector
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.powernukkit:powernukkit
<1.5.2.1
1.5.2.1

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.