By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade parfait-examplesUpgrade si-units-javadocUpgrade uom-seUpgrade si-unitsUpgrade uom-libUpgrade uom-lib-javadocUpgrade unit-api-javadocUpgrade unit-apiUpgrade uom-systemsUpgrade uom-parentUpgrade uom-se-javadocUpgrade uom-systems-javadocUpgrade parfaitUpgrade pcp-parfait-agentUpgrade parfait-javadoc | May 4, 2022 | Jan 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade log4jUpgrade log4j-manualUpgrade log4j-javadoc | Jul 4, 2022 | Jan 18, 2022 |
| Amazon_linux | — | Upgrade log4j | Apr 6, 2023 | Jan 18, 2022 |
| Centos_linux | — | Upgrade unit-apiUpgrade uom-systems-javadocUpgrade pcp-parfait-agentUpgrade uom-libUpgrade uom-systemsUpgrade uom-seUpgrade parfait-javadocUpgrade log4j-javadocUpgrade log4j-debuginfoUpgrade unit-api-javadocUpgrade uom-parentUpgrade uom-se-javadocUpgrade parfait-examplesUpgrade log4j-manualUpgrade si-units-javadocUpgrade parfaitUpgrade log4jUpgrade si-unitsUpgrade uom-lib-javadoc | Feb 17, 2022 | Jan 18, 2022 |
| Debian | — | Upgrade apache-log4j1.2 | Feb 2, 2022 | Jan 18, 2022 |
| Gentoo Linux | — | Upgrade dev-java/log4j. | Feb 19, 2024 | Jan 18, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade log4j | May 25, 2022 | Jan 18, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade log4j | Mar 22, 2022 | Jan 18, 2022 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Aug 26, 2022 | Jan 18, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34011596 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34010914 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34012040 for version 12.2.1.4.0. | Jul 25, 2022 | Jan 18, 2022 |
| Oracle_linux | — | Upgrade unit-apiUpgrade unit-api-javadocUpgrade uom-parentUpgrade log4j-javadocUpgrade log4jUpgrade uom-seUpgrade uom-systemsUpgrade uom-se-javadocUpgrade si-unitsUpgrade parfait-examplesUpgrade parfaitUpgrade pcp-parfait-agentUpgrade parfait-javadocUpgrade uom-libUpgrade si-units-javadocUpgrade log4j-manualUpgrade uom-systems-javadocUpgrade uom-lib-javadoc | Jan 28, 2022 | Jan 18, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jan 18, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Jan 18, 2022 |
| Redhat_linux | — | Upgrade unit-api-javadocUpgrade parfait-examplesUpgrade uom-se-javadocUpgrade log4jUpgrade log4j-javadocUpgrade si-unitsUpgrade uom-parentUpgrade parfaitUpgrade si-units-javadocUpgrade uom-systemsUpgrade log4j-manualUpgrade parfait-javadocUpgrade uom-libUpgrade uom-lib-javadocUpgrade unit-apiUpgrade uom-seUpgrade pcp-parfait-agentUpgrade log4j-debuginfoUpgrade uom-systems-javadoc | Jan 27, 2022 | Jan 18, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Jan 18, 2022 |
| Suse | — | Upgrade kafka-sourceUpgrade log4j12-manualUpgrade log4jUpgrade log4j-manualUpgrade log4j12Upgrade kafka-kitUpgrade log4j12-javadoc | Jan 27, 2022 | Jan 18, 2022 |
| Ubuntu | — | Upgrade liblog4j1.2-java (Ubuntu Pro)Upgrade liblog4j1.2-java | Apr 10, 2023 | Jan 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub