JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade si-unitsUpgrade unit-api-javadocUpgrade uom-seUpgrade uom-se-javadocUpgrade uom-systemsUpgrade parfaitUpgrade parfait-examplesUpgrade unit-apiUpgrade uom-parentUpgrade parfait-javadocUpgrade si-units-javadocUpgrade uom-lib-javadocUpgrade pcp-parfait-agentUpgrade uom-libUpgrade uom-systems-javadoc | May 4, 2022 | Dec 14, 2021 |
| Amazon Linux Ami 2 | — | Upgrade log4j-manualUpgrade log4jUpgrade log4j-javadoc | Jul 4, 2022 | Dec 14, 2021 |
| Amazon_linux | — | Upgrade log4j | Jan 20, 2022 | Dec 14, 2021 |
| Centos_linux | — | Upgrade unit-api-javadocUpgrade pcp-parfait-agentUpgrade log4j-javadocUpgrade log4jUpgrade uom-se-javadocUpgrade parfait-examplesUpgrade uom-lib-javadocUpgrade uom-systemsUpgrade uom-parentUpgrade uom-libUpgrade unit-apiUpgrade uom-systems-javadocUpgrade parfait-javadocUpgrade parfaitUpgrade log4j-manualUpgrade si-unitsUpgrade log4j-debuginfoUpgrade si-units-javadocUpgrade uom-se | Dec 21, 2021 | Dec 14, 2021 |
| Debian | — | Upgrade apache-log4j1.2 | Feb 2, 2022 | Dec 14, 2021 |
| Gentoo Linux | — | Upgrade games-server/minecraft-server.Upgrade net-wireless/unifi.Upgrade dev-embedded/arduino.Upgrade app-backup/tsm. | Sep 8, 2022 | Dec 14, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade log4j | Mar 2, 2022 | Dec 14, 2021 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Aug 26, 2022 | Dec 21, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 33727616 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 33494824 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 33727619 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 33699205 for version 12.2.1.3.0. | Feb 28, 2022 | Dec 14, 2021 |
| Oracle_linux | — | Upgrade uom-systems-javadocUpgrade parfait-javadocUpgrade log4j-manualUpgrade uom-libUpgrade pcp-parfait-agentUpgrade uom-lib-javadocUpgrade si-units-javadocUpgrade uom-seUpgrade log4jUpgrade parfaitUpgrade parfait-examplesUpgrade unit-api-javadocUpgrade uom-systemsUpgrade uom-se-javadocUpgrade uom-parentUpgrade si-unitsUpgrade unit-apiUpgrade log4j-javadoc | Dec 21, 2021 | Dec 10, 2021 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Dec 14, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Dec 10, 2021 |
| Red_hat Jboss_eap | — | — | Mar 14, 2022 | Dec 14, 2021 |
| Redhat_linux | — | Upgrade log4jUpgrade si-unitsUpgrade parfait-javadocUpgrade uom-systemsUpgrade parfaitUpgrade si-units-javadocUpgrade log4j-manualUpgrade pcp-parfait-agentUpgrade uom-parentUpgrade log4j-debuginfoUpgrade uom-se-javadocUpgrade uom-systems-javadocUpgrade uom-libUpgrade uom-seUpgrade log4j-javadocUpgrade parfait-examplesUpgrade unit-api-javadocUpgrade unit-apiUpgrade uom-lib-javadoc | Dec 21, 2021 | Dec 14, 2021 |
| Rocky_linux | — | — | Mar 5, 2024 | Dec 14, 2021 |
| Suse | — | Upgrade log4j-jclUpgrade log4j12-miniUpgrade kafka-kitUpgrade log4j-slf4jUpgrade log4j12Upgrade log4j12-manualUpgrade log4j-javadocUpgrade log4j-manualUpgrade log4j12-javadocUpgrade kafka-sourceUpgrade log4j | Dec 18, 2021 | Dec 14, 2021 |
| Ubuntu | — | Upgrade liblog4j1.2-java (Ubuntu Pro)Upgrade liblog4j1.2-java | Jan 14, 2022 | Dec 14, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub