JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade uom-parentUpgrade uom-libUpgrade unit-api-javadocUpgrade uom-systemsUpgrade uom-seUpgrade parfait-examplesUpgrade uom-se-javadocUpgrade unit-apiUpgrade si-unitsUpgrade uom-systems-javadocUpgrade pcp-parfait-agentUpgrade parfaitUpgrade uom-lib-javadocUpgrade parfait-javadocUpgrade si-units-javadoc | May 4, 2022 | Jan 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade log4j-manualUpgrade log4j-javadocUpgrade log4j | Jul 4, 2022 | Jan 18, 2022 |
| Amazon_linux | — | amazon-linux-upgrade-log4j | Apr 6, 2023 | Jan 18, 2022 |
| Centos_linux | — | Upgrade log4jUpgrade unit-apiUpgrade pcp-parfait-agentUpgrade log4j-manualUpgrade parfaitUpgrade si-unitsUpgrade parfait-examplesUpgrade log4j-debuginfoUpgrade si-units-javadocUpgrade parfait-javadocUpgrade unit-api-javadocUpgrade uom-systemsUpgrade uom-seUpgrade uom-se-javadocUpgrade uom-libUpgrade uom-parentUpgrade uom-systems-javadocUpgrade log4j-javadocUpgrade uom-lib-javadoc | Feb 17, 2022 | Jan 18, 2022 |
| Debian | — | Upgrade apache-log4j1.2 | Feb 2, 2022 | Jan 18, 2022 |
| Gentoo Linux | — | Upgrade dev-java/log4j. | Feb 19, 2024 | Jan 18, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade log4j | May 25, 2022 | Jan 18, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade log4j | Mar 22, 2022 | Jan 18, 2022 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Aug 26, 2022 | Jan 18, 2022 |
| Oracle_linux | — | oracle-linux-upgrade-log4joracle-linux-upgrade-log4j-javadocoracle-linux-upgrade-log4j-manualoracle-linux-upgrade-parfaitoracle-linux-upgrade-parfait-examplesoracle-linux-upgrade-parfait-javadocoracle-linux-upgrade-pcp-parfait-agentoracle-linux-upgrade-si-unitsoracle-linux-upgrade-si-units-javadocoracle-linux-upgrade-unit-apioracle-linux-upgrade-unit-api-javadocoracle-linux-upgrade-uom-liboracle-linux-upgrade-uom-lib-javadocoracle-linux-upgrade-uom-parentoracle-linux-upgrade-uom-seoracle-linux-upgrade-uom-se-javadocoracle-linux-upgrade-uom-systemsoracle-linux-upgrade-uom-systems-javadoc | Jan 28, 2022 | Jan 18, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jan 18, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Jan 18, 2022 |
| Redhat_linux | — | Upgrade si-units-javadocUpgrade pcp-parfait-agentUpgrade log4j-manualUpgrade unit-apiUpgrade parfaitUpgrade parfait-examplesUpgrade si-unitsUpgrade log4jUpgrade uom-lib-javadocUpgrade uom-libUpgrade uom-systems-javadocUpgrade uom-seUpgrade uom-se-javadocUpgrade uom-parentUpgrade uom-systemsUpgrade log4j-javadocUpgrade parfait-javadocUpgrade log4j-debuginfoUpgrade unit-api-javadoc | Jan 27, 2022 | Jan 18, 2022 |
| Suse | — | suse-upgrade-kafka-kitsuse-upgrade-kafka-sourcesuse-upgrade-log4jsuse-upgrade-log4j-manualsuse-upgrade-log4j12suse-upgrade-log4j12-javadocsuse-upgrade-log4j12-manual | Jan 27, 2022 | Jan 18, 2022 |
| Ubuntu | ubuntu-pro-upgrade-liblog4j1-2-javaubuntu-upgrade-liblog4j1-2-java | Apr 10, 2023 | Jan 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub