CVE-2021-4104

Publication date 14 December 2021

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache-log4j1.2	25.04 plucky	Vulnerable
	24.10 oracular	Vulnerable
	24.04 LTS noble	Vulnerable
	23.10 mantic	Ignored end of life, was needed
	23.04 lunar	Ignored end of life, was needed
	22.10 kinetic	Not affected
	22.04 LTS jammy	Not affected
	21.10 impish	Fixed 1.2.17-10ubuntu0.21.10.1
	21.04 hirsute	Fixed 1.2.17-10ubuntu0.21.04.1
	20.04 LTS focal	Fixed 1.2.17-9ubuntu0.1
	18.04 LTS bionic	Fixed 1.2.17-8+deb10u1ubuntu0.1
	16.04 LTS xenial	Fixed 1.2.17-7ubuntu1+esm1 Ubuntu Pro
	14.04 LTS trusty	Fixed 1.2.17-4ubuntu3+esm1 Ubuntu Pro

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

This issue is similar to CVE-2021-44228, but for log2j < 2.0 and is only vulnerable if configured to use JMSAppender. For an environment to be vulnerable, an attacker would need write access to the log4j.properties configuration file to specifically enable the JMS Appender and configure it with a JNDI lookup to a third party server. If an attacker has write access to the log4j.properties configuration file, there are also other configuration options that can be used to perform code execution attacks. We therefore recommend configuration files be set with appropriate permissions to only permit being modified by trusted individuals.

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H