Apache log4j: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode

Summary

Product

Vulnerabilities 1

• High 7.5
  CVE-2021-4104 Public exploit EPSS 81%

  Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

  JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Dec 14, 2021

Revision history

1. 2024-05-14 #50

   Neue Updates von IBM aufgenommen

2. 2023-12-21 #49

   Neue Updates von Gentoo aufgenommen

3. 2023-10-29 #48

   Neue Updates von IBM aufgenommen

4. 2023-07-24 #47

   Neue Updates von IBM aufgenommen

5. 2022-10-26 #46

   Neue Updates von IBM aufgenommen

6. 2022-10-23 #45

   Neue Updates von IBM aufgenommen

7. 2022-10-16 #44

   Neue Updates von IBM aufgenommen

8. 2022-09-20 #43

   Neue Updates von HCL aufgenommen

9. 2022-08-14 #42

   Neue Updates von HCL aufgenommen

10. 2022-07-24 #41

    Neue Updates von HCL aufgenommen

11. 2022-06-30 #40

    Neue Updates von Red Hat aufgenommen

12. 2022-05-23 #39

    Neue Updates von Oracle Linux aufgenommen

13. 2022-05-17 #38

    Neue Updates von HCL aufgenommen

14. 2022-04-27 #37

    Neue Updates von HCL und IBM aufgenommen

15. 2022-04-26 #36

    Neue Updates von AVAYA aufgenommen

16. 2022-04-24 #35

    Neue Updates von HCL aufgenommen

17. 2022-04-11 #34

    Neue Updates von Red Hat aufgenommen

18. 2022-04-04 #33

    Neue Updates von IBM aufgenommen

19. 2022-03-29 #32

    Neue Updates von HCL aufgenommen

20. 2022-03-24 #31

    Neue Updates von HCL aufgenommen

21. 2022-03-22 #30

    Neue Updates von IBM aufgenommen

22. 2022-03-15 #29

    Neue Updates von IBM aufgenommen

23. 2022-02-23 #28

    Neue Updates von Red Hat aufgenommen

24. 2022-02-15 #27

    Neue Updates von Red Hat aufgenommen

25. 2022-02-14 #26

    Neue Updates von Red Hat aufgenommen

References

• NVD NIST vom 2021-12-15
  https://nvd.nist.gov/vuln/detail/CVE-2021-4104
• IBM Security Advisory vom 2021-12-15
  https://www.ibm.com/support/pages/node/6526432
• Red Hat Security Advisory RHSA-2021:5148 vom 2021-12-15
  https://access.redhat.com/errata/RHSA-2021:5148
• SUSE Security Update SUSE-SU-2021:4096-1 vom 2021-12-15
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009911.html
• SUSE Security Update SUSE-SU-2021:4097-1 vom 2021-12-15
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009912.html
• Atlassian Security Advisory - Log4j
  https://confluence.atlassian.com/security/multiple-products-security-advisory-log4j-vulnerable-to-remote-code-execution-cve-2021-44228-1103069934.html
• Red Hat Security Advisory RHSA-2021:5186 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5186
• IBM Security Bulletin 6527226 vom 2021-12-17
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-some-features-of-ibm-db2-on-openshift-and-ibm-db2-and-db2-warehouse-on-cloud-pak-for-data-cve-2021-44228/
• Red Hat Security Advisory RHSA-2021:5183 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5183
• Red Hat Security Advisory RHSA-2021:5184 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5184
• Red Hat Security Advisory RHSA-2021:5141 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5141
• Red Hat Security Advisory RHSA-2021:5107 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5107
• Log4j Vulnerabilities Impact On Oracle E-Business Suite Analysis
  https://www.integrigy.com/security-resources/log4j-vulnerabilities-impact-oracle-e-business-suite-analysis
• Atos Security Advisory Report - OBSO-2112-01
  https://networks.unify.com/security/advisories/OBSO-2112-01.pdf
• HCL Article KB0095587 vom 2021-12-17
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095587
• IBM Security Bulletin 6527952 vom 2021-12-18
  https://www.ibm.com/blogs/psirt/security-bulletin-log4shell-vulnerability-affects-ibm-spss-statistics-cve-2021-4104/
• SUSE Security Update SUSE-SU-2021:4112-1 vom 2021-12-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009916.html
• IBM Security Bulletin 6527834 vom 2021-12-18
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-cve-2021-4104-affects-infosphere-data-replication/
• SUSE Security Update SUSE-SU-2021:4115-1 vom 2021-12-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009918.html
• SUSE Security Update SUSE-SU-2021:4111-1 vom 2021-12-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009917.html
• SUSE Security Update SUSE-SU-2021:14866-1 vom 2021-12-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009915.html
• Red Hat Security Advisory RHSA-2021:5206 vom 2021-12-20
  https://access.redhat.com/errata/RHSA-2021:5206
• Oracle Linux Security Advisory ELSA-2021-5206 vom 2021-12-21
  https://linux.oracle.com/errata/ELSA-2021-5206.html
• IBM Security Bulletin 6528678 vom 2021-12-22
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-some-features-of-ibm-db2-cve-2021-4104/
• IBM Security Bulletin 6529056 vom 2021-12-22
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-app-connect-enterprise-v11-v12-and-ibm-integration-bus-cve-2021-4104/
• CentOS Security Advisory CESA-2021:5206 vom 2021-12-21
  https://lists.centos.org/pipermail/centos-announce/2021-December/060975.html
• SUSE Security Update SUSE-SU-2021:4160-1 vom 2021-12-22
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009934.html
• IBM Security Bulletin 6536868 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-apache-log4j-shipped-with-ibm-tivoli-netcool-omnibus-common-integration-libraries-cve-2021-4104-cve-2021-45046-cve-2021-44228/
• Red Hat Security Advisory RHSA-2021:5269 vom 2021-12-23
  https://access.redhat.com/errata/RHSA-2021:5269
• SUSE Security Update SUSE-SU-2021:4190-1 vom 2021-12-24
  https://lists.suse.com/pipermail/sle-security-updates/2021-December/009943.html
• EMC Security Advisory DSA-2021-274 vom 2022-01-09
  https://www.dell.com/support/kbdoc/de-de/000194503/dsa-2021-274-dell-emc-data-domain-security-update-for-apache-log4j-remote-code-execution-vulnerability-cve-2021-44228
• HPE Security Bulletin HPESBGN04215 rev.10 vom 2022-01-08
  https://support.hpe.com/hpesc/public/docDisplay?elq_mid=17739&elq_cid=67018031&docId=hpesbgn04215en_us
• IBM Security Bulletin 6539408 vom 2022-01-11
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affect-the-ibm-websphere-application-server-and-ibm-security-guardium-key-lifecycle-manager-cve-2021-4104-cve-2021-45046-cve-2021-45105/
• Juniper Security Bulletin JSA11287 vom 2022-01-12
  https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11287&cat=SIRT_1
• Ubuntu Security Notice USN-5223-1 vom 2022-01-13
  https://ubuntu.com/security/notices/USN-5223-1
• IBM Security Bulletin 6540892 vom 2022-01-15
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-some-features-of-ibm-spss-analytic-server-cve-2021-4104/
• Unify Security Advisory Report OBSO-2201-01 vom 2022-01-18
  https://networks.unify.com/security/advisories/OBSO-2201-01.pdf
• Amazon Linux Security Advisory ALAS-2022-1562 vom 2022-01-20
  https://alas.aws.amazon.com/ALAS-2022-1562.html
• SUSE Security Update SUSE-SU-2022:0126-1 vom 2022-01-19
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010026.html
• SUSE Security Update SUSE-SU-2022:0133-1 vom 2022-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010032.html
• IBM Security Bulletin 6550448 vom 2022-01-25
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-ibm-data-studio-client-cve-2021-4104/
• Red Hat Security Advisory RHSA-2022:0291 vom 2022-01-26
  https://access.redhat.com/errata/RHSA-2022:0291
• Red Hat Security Advisory RHSA-2022:0289 vom 2022-01-26
  https://access.redhat.com/errata/RHSA-2022:0289
• Red Hat Security Advisory RHSA-2022:0294 vom 2022-01-26
  https://access.redhat.com/errata/RHSA-2022:0294
• Oracle Linux Security Advisory ELSA-2022-9056 vom 2022-01-26
  https://linux.oracle.com/errata/ELSA-2022-9056.html
• Red Hat Security Advisory RHSA-2022:0290 vom 2022-01-26
  https://access.redhat.com/errata/RHSA-2022:0290
• Oracle Linux Security Advisory ELSA-2022-0290 vom 2022-01-27
  http://linux.oracle.com/errata/ELSA-2022-0290.html
• Amazon Linux Security Advisory ALAS-2022-1739 vom 2022-01-27
  https://alas.aws.amazon.com/AL2/ALAS-2022-1739.html
• IBM Security Bulletin 6551880 vom 2022-01-29
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-ibm-spectrum-scale-cve-2021-4104/
• Debian Security Advisory DLA-2905 vom 2022-01-31
  https://lists.debian.org/debian-lts-announce/2022/01/msg00033.html
• Red Hat Security Advisory RHSA-2022:0436 vom 2022-02-04
  https://access.redhat.com/errata/RHSA-2022:0436
• IBM Security Bulletin 6553622 vom 2022-02-04
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-informix-dynamic-server-is-vulnerable-to-arbitrary-code-execution-due-to-apache-log4j-cve-2021-44228-3/
• IBM Security Bulletin 6553626 vom 2022-02-04
  https://www.ibm.com/blogs/psirt/security-bulletin-log4j-vulnerability-cve-2021-44228-in-ibm-informix-dynamic-server-in-cloud-pak-for-data-2/
• Red Hat Security Advisory RHSA-2022:0438 vom 2022-02-04
  https://access.redhat.com/errata/RHSA-2022:0438
• Red Hat Security Advisory RHSA-2022:0430 vom 2022-02-03
  https://access.redhat.com/errata/RHSA-2022:0430
• Red Hat Security Advisory RHSA-2022:0435 vom 2022-02-04
  https://access.redhat.com/errata/RHSA-2022:0435
• Red Hat Security Advisory RHSA-2022:0437 vom 2022-02-04
  https://access.redhat.com/errata/RHSA-2022:0437
• Red Hat Security Advisory RHSA-2022:0450 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0450
• Red Hat Security Advisory RHSA-2022:0445 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0445
• Red Hat Security Advisory RHSA-2022:0448 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0448
• Red Hat Security Advisory RHSA-2022:0449 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0449
• Red Hat Security Advisory RHSA-2022:0446 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0446
• Red Hat Security Advisory RHSA-2022:0447 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0447
• Red Hat Security Advisory RHSA-2022:0444 vom 2022-02-08
  https://access.redhat.com/errata/RHSA-2022:0444
• Red Hat Security Advisory RHSA-2022:0475 vom 2022-02-09
  https://access.redhat.com/errata/RHSA-2022:0475
• Red Hat Security Advisory RHSA-2022:0497 vom 2022-02-09
  https://access.redhat.com/errata/RHSA-2022:0497
• SUSE Security Update SUSE-SU-2022:0354-1 vom 2022-02-09
  https://lists.suse.com/pipermail/sle-security-updates/2022-February/010195.html
• SUSE Security Update SUSE-SU-2022:0355-1 vom 2022-02-09
  https://lists.suse.com/pipermail/sle-security-updates/2022-February/010196.html
• HCL Article KB0097471 vom 2022-05-18
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097471
• Red Hat Security Advisory RHSA-2022:0507 vom 2022-02-10
  https://access.redhat.com/errata/RHSA-2022:0507
• Red Hat Security Advisory RHSA-2022:0527 vom 2022-02-14
  https://access.redhat.com/errata/RHSA-2022:0527
• Red Hat Security Advisory RHSA-2022:0524 vom 2022-02-14
  https://access.redhat.com/errata/RHSA-2022:0524
• Red Hat Security Advisory RHSA-2022:0553 vom 2022-02-15
  https://access.redhat.com/errata/RHSA-2022:0553
• Red Hat Security Advisory RHSA-2022:0661 vom 2022-02-23
  https://access.redhat.com/errata/RHSA-2022:0661
• Oracle Linux Security Advisory ELSA-2022-9419 vom 2022-05-23
  https://linux.oracle.com/errata/ELSA-2022-9419.html
• IBM Security Bulletin 6563561 vom 2022-03-16
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-vulnerable-to-arbitrary-code-execution-due-to-apache-log4j-cve-2021-4104/
• IBM Security Bulletin 6565387 vom 2022-03-23
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-websphere-service-registry-and-repository-cve-2021-4104/
• HCL Article KB0097470 vom 2022-03-25
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097470
• HCL Article KB0096807 vom 2022-03-29
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096807
• IBM Security Bulletin
  https://www.ibm.com/support/pages/node/6569189