Skip to content
Fencer Vulns
high 8.1

GHSA-3w6p-8f82-gw8r json

Using JMSAppender in log4j configuration may lead to deserialization of untrusted data

published 2021-12-17 4 y ago modified 2024-12-03 23 mo ago

cvss
8.1
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.

### Patches

The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.

### Workarounds

1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker 2. Alternatively, you can issue below command to remove `JMSAppender.class`:

```(bash) # install zip command if you don't have apt-get update && apt-get install -y zip # remove the class zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class ```

### References

Please refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.

### For more information

If you have any questions or comments about this advisory, please feel free to open an issue in the repository.

Patch / fix

  • maven ru.yandex.clickhouse:clickhouse-jdbc-bridge 2.0.7

CVSS scores

assigned by version score vector
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven ru.yandex.clickhouse:clickhouse-jdbc-bridge
<2.0.7
2.0.7

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.