{"id":"GHSA-3w6p-8f82-gw8r","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3w6p-8f82-gw8r","summary":"Using JMSAppender in log4j configuration may lead to deserialization of untrusted data","details":"### Impact\n\nClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.\n\n### Patches\n\nThe patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.\n\n### Workarounds\n\n1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker\n2. Alternatively, you can issue below command to remove `JMSAppender.class`:\n\n```(bash)\n# install zip command if you don't have\napt-get update && apt-get install -y zip\n# remove the class\nzip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class\n```\n\n### References\n\nPlease refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please feel free to open an issue in the repository.\n","published":"2021-12-17T20:42:38Z","modified":"2024-12-03T06:08:49.894411Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"ru.yandex.clickhouse:clickhouse-jdbc-bridge","fixedVersion":"2.0.7"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ClickHouse/clickhouse-jdbc-bridge/security/advisories/GHSA-3w6p-8f82-gw8r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4104"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2021-4104"},{"type":"PACKAGE","url":"https://github.com/ClickHouse/clickhouse-jdbc-bridge"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-03T06:08:49.894411Z"}}