Summary
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) contain a vulnerability (CVE-2021-44832) that could allow an attacker with permission to modify the logging configuration file to execute arbitrary code, when the JDBC Appender is used [1].
This advisory informs about the impact of CVE-2021-44832 to Siemens products and the corresponding remediation and mitigation measures. The vulnerability is different from other JNDI lookup vulnerabilities, the impact of which is documented in SSA-661247 [2].
Currently, no products vulnerable to CVE-2021-44832 have been identified.
Siemens is investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status.
[1] https://logging.apache.org/log4j/2.x/security.html
[2] https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
Vulnerabilities 1
-
Medium 6.6
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…
Revision history
-
#1
Publication Date
References
-
SSA-784507: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf
-
SSA-784507: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-784507.txt