{"id":"GHSA-3qpm-h9ch-px3c","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3qpm-h9ch-px3c","summary":"Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library","details":"### Summary\nThe version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser.\nIt's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and  CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).\n\n### Impact\nMalicious client code could be used to send messages and cause remote code execution on the server.\n\n### Patches\nPowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`.\nAll versions prior to `1.5.2.1` are affected and are not patched.\n\n### Workarounds\nIf you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.\n\n### References\nhttps://github.com/advisories/GHSA-jfh8-c2jp-5v3q\nhttps://github.com/advisories/GHSA-p6xc-xr62-6r2g\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)\n","published":"2022-01-06T18:31:23Z","modified":"2024-12-04T05:40:03.827618Z","cvss":{"score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.powernukkit:powernukkit","fixedVersion":"1.5.2.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/PowerNukkit/PowerNukkit/security/advisories/GHSA-3qpm-h9ch-px3c"},{"type":"PACKAGE","url":"https://github.com/PowerNukkit/PowerNukkit"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-04T05:40:03.827618Z"}}