REDHAT-BUG-2041949: Medium severity Apache Log4j vulnerability
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104.
Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default.
References:
https://www.openwall.com/lists/oss-security/2022/01/18/3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove/disable any Log4j 1.x configuration that specifically uses JMSSink (it is not enabled by default). This prevents the deserialization of untrusted data and the JMSSink JNDI requests that can lead to remote code execution.
Log4j 1.x JMSSink usage (JMSSink configured appender) / JMSSink references = Disable or remove JMSSink configuration so Log4j is not configured to use JMSSink - Compensating control
Ensure an attacker cannot modify Log4j configuration and cannot supply configuration values such as TopicConnectionFactoryBindingName (i.e., restrict write access to Log4j configuration files and configuration management systems).
- Compensating control
If Log4j 1.x JMSSink is used, ensure the LDAP/JNDI endpoints it can reach are not attacker-accessible (restrict network access/identity/ACLs so the attacker cannot control the LDAP service referenced by the JMSSink configuration).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2041949?
The severity of REDHAT-BUG-2041949 is high due to the potential for remote code execution through deserialization vulnerabilities.
How do I fix REDHAT-BUG-2041949?
To fix REDHAT-BUG-2041949, update to a supported version of Log4j that is not affected by this vulnerability.
What versions of Log4j are affected by REDHAT-BUG-2041949?
REDHAT-BUG-2041949 affects all versions of Log4j 1.x.
What should I do if I have write access to the Log4j configuration regarding REDHAT-BUG-2041949?
If you have write access to the Log4j configuration, ensure it does not reference any untrusted LDAP services to mitigate the risk of exploitation associated with REDHAT-BUG-2041949.
Are there any known exploits for REDHAT-BUG-2041949?
Yes, there are known exploitation techniques that leverage the deserialization vulnerability in REDHAT-BUG-2041949.