REDHAT-BUG-2041959: High severity Apache Log4j vulnerability
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converted from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed.
Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs.
References:
https://www.openwall.com/lists/oss-security/2022/01/18/4
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2041959?
The severity of REDHAT-BUG-2041959 is considered high due to the potential SQL injection vulnerability.
How do I fix REDHAT-BUG-2041959?
To fix REDHAT-BUG-2041959, upgrade to a version of Log4j that is not affected, or implement input validation and sanitization for user-supplied data.
What versions are affected by REDHAT-BUG-2041959?
REDHAT-BUG-2041959 affects all versions of Apache Log4j 1.2.x.
What type of vulnerability is REDHAT-BUG-2041959?
REDHAT-BUG-2041959 is an SQL injection vulnerability that can be exploited via crafted strings in SQL statements.
Who is responsible for resolving REDHAT-BUG-2041959?
It is the responsibility of system administrators and developers to resolve REDHAT-BUG-2041959 by applying the necessary updates and patches.