access.redhat.com
Open in
urlscan Pro
2a02:26f0:480:d::210:f14d
Public Scan
Submitted URL: http://access.redhat.com/security/cve/CVE-2021-4104
Effective URL: https://access.redhat.com/security/cve/CVE-2021-4104
Submission: On March 11 via api from IN — Scanned from IT
Effective URL: https://access.redhat.com/security/cve/CVE-2021-4104
Submission: On March 11 via api from IN — Scanned from IT
Form analysis 1 forms found in the DOM
Name: topSearchForm — GET /search/browse/search/
<form class="ng-pristine ng-valid topSearchForm" id="topSearchForm" name="topSearchForm" action="/search/browse/search/" method="get" enctype="application/x-www-form-urlencoded">
<cp-search-autocomplete class="push-bottom" path="/webassets/avalon/j/data.json" pfelement="" type="container"></cp-search-autocomplete>
<div> Or <a href="/support/cases/#/troubleshoot">troubleshoot an issue</a>. </div>
</form>Text Content
Skip to navigation Skip to main content
UTILITIES
* Subscriptions
* Downloads
* Containers
* Support Cases
* Subscriptions
* Downloads
* Containers
* Support Cases
* Products & Services
PRODUCTS
SUPPORT
* Production Support
* Development Support
* Product Life Cycles
SERVICES
* Consulting
* Technical Account Management
* Training & Certifications
DOCUMENTATION
* Red Hat Enterprise Linux
* Red Hat JBoss Enterprise Application Platform
* Red Hat OpenStack Platform
* Red Hat OpenShift Container Platform
All Documentation
ECOSYSTEM CATALOG
* Red Hat Partner Ecosystem
* Partner Resources
* Tools
TOOLS
* Troubleshoot a product issue
* Packages
* Errata
CUSTOMER PORTAL LABS
* Configuration
* Deployment
* Security
* Troubleshoot
All labs
RED HAT INSIGHTS
Increase visibility into IT operations to detect and resolve technical issues
before they impact your business.
Learn More
Go to Insights
* Security
RED HAT PRODUCT SECURITY CENTER
Engage with our Red Hat Product Security team, access security updates, and
ensure your environments are not exposed to any known security
vulnerabilities.
Product Security Center
SECURITY UPDATES
* Security Advisories
* Red Hat CVE Database
* Security Labs
Keep your systems secure with Red Hat's specialized responses to security
vulnerabilities.
View Responses
RESOURCES
* Security Blog
* Security Measurement
* Severity Ratings
* Backporting Policies
* Product Signing (GPG) Keys
* Community
CUSTOMER PORTAL COMMUNITY
* Discussions
* Private Groups
Community Activity
CUSTOMER EVENTS
* Red Hat Convergence
* Red Hat Summit
STORIES
* Red Hat Subscription Value
* You Asked. We Acted.
* Open Source Communities
Or troubleshoot an issue.
English
SELECT YOUR LANGUAGE
* English
* Français
* 한국어
* 日本語
* 中文 (中国)
Infrastructure and Management
* Red Hat Enterprise Linux
* Red Hat Satellite
* Red Hat Subscription Management
* Red Hat Insights
* Red Hat Ansible Automation Platform
Cloud Computing
* Red Hat OpenShift
* Red Hat OpenStack Platform
* Red Hat OpenShift Container Platform
* Red Hat OpenShift AI
* Red Hat OpenShift Dedicated
* Red Hat Advanced Cluster Security for Kubernetes
* Red Hat Advanced Cluster Management for Kubernetes
* Red Hat Quay
* OpenShift Dev Spaces
* Red Hat OpenShift Service on AWS
Storage
* Red Hat Gluster Storage
* Red Hat Hyperconverged Infrastructure
* Red Hat Ceph Storage
* Red Hat OpenShift Data Foundation
Runtimes
* Red Hat Runtimes
* Red Hat JBoss Enterprise Application Platform
* Red Hat Data Grid
* Red Hat JBoss Web Server
* Red Hat build of Keycloak
* Red Hat support for Spring Boot
* Red Hat build of Node.js
* Red Hat build of Quarkus
Integration and Automation
* Red Hat Application Foundations
* Red Hat Fuse
* Red Hat AMQ
* Red Hat 3scale API Management
All Products
All Red Hat
Back to menu
QUICK LINKS: REDHAT.COM, CUSTOMER PORTAL, RED HAT'S DEVELOPER SITE, RED HAT'S
PARTNER SITE.
* You are here
RED HAT
Learn about our open source products, services, and company.
* You are here
RED HAT CUSTOMER PORTAL
Get product support and knowledge from the open source experts.
* You are here
RED HAT DEVELOPER
Read developer tutorials and download Red Hat software for cloud application
development.
* You are here
RED HAT PARTNER CONNECT
Get training, subscriptions, certifications, and more for partners to build,
sell, and support customer solutions.
PRODUCTS & TOOLS
* ANSIBLE.COM
Learn about and try our IT automation product.
* RED HAT ECOSYSTEM CATALOG
Find hardware, software, and cloud providers―and download container
images―certified to perform with Red Hat technologies.
TRY, BUY, & SELL
* RED HAT HYBRID CLOUD CONSOLE
Access technical how-tos, tutorials, and learning paths focused on Red Hat’s
hybrid cloud managed services.
* RED HAT STORE
Buy select Red Hat products and services online.
* RED HAT MARKETPLACE
Try, buy, sell, and manage certified enterprise software for container-based
environments.
EVENTS
* RED HAT SUMMIT AND ANSIBLEFEST
Register for and learn about our annual open source IT industry event.
We're sorry but cve-details doesn't work properly without JavaScript enabled.
Please enable it to continue.
CVE-2021-4104
Public on
Last Modified: UTC
ModerateModerate ImpactWhat does this mean?
7.5CVSS Score Breakdown
INSIGHTS VULNERABILITY ANALYSIS
View exposed systems
DESCRIPTION
A flaw was found in the Java logging library Apache Log4j in version 1.x.
JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data.
This allows a remote attacker to execute code on the server if the deployed
application is configured to use JMSAppender and to the attacker's JNDI LDAP
endpoint.
A flaw was found in the Java logging library Apache Log4j in version 1.x.
JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data.
This allows a remote attacker to execute code on the server if the deployed
application is configured to use JMSAppender and to the attacker's JNDI LDAP
endpoint.
SECURITY BULLETIN
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
STATEMENT
Based on the conditions to be exploitable (see details below), the risk is much
lower than Log4j 2.x and Red Hat has assessed this to be Moderate severity. This
flaw has been filed for Log4j 1.x, and the corresponding flaw information for
Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228
Note this flaw ONLY affects applications which are specifically configured to
use JMSAppender, which is not the default, or when the attacker has write access
to the Log4j configuration for adding JMSAppender to the attacker's JNDI LDAP
endpoint. If the Log4j configuration is set TopicBindingName or
TopicConnectionFactoryBindingName configurations allowing JMSAppender to perform
JNDI requests that result in remote code execution in a similar fashion to
CVE-2021-44228 Log4j 2.x, Log4j 1.x is vulnerable. However, the attack vector is
reduced as it depends on having write access, which is not a standard
configuration rather than untrusted user input. These are sufficient factors
beyond the attacker's control. The tomcat package shipped with Red Hat
Enterprise Linux does not include log4j but it does include a default
configuration for log4j, log4j.properties, which could be used with tomcat if
users choose to install and configure the library. The JMSAppender is not
enabled by default, and the permissions of the file can only be modified as
root. Red Hat Virtualization ships log4j12-1.2.17, but it is used and configured
in a way which makes this flaw not possible to exploit. Therefore impact is
rated Low.
Based on the conditions to be exploitable (see details below), the risk is much
lower than Log4j 2.x and Red Hat has assessed this to be Moderate severity. This
flaw has been filed for Log4j 1.x, and the corresponding flaw information for
Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228
Note this flaw ONLY affects applications which are specifically configured to
use JMSAppender, which is not the default, or when the attacker has write access
to the Log4j configuration for adding JMSAppender to the attacker's JNDI LDAP
endpoint.
If the Log4j configuration is set TopicBindingName or
TopicConnectionFactoryBindingName configurations allowing JMSAppender to perform
JNDI requests that result in remote code execution in a similar fashion to
CVE-2021-44228 Log4j 2.x, Log4j 1.x is vulnerable. However, the attack vector is
reduced as it depends on having write access, which is not a standard
configuration rather than untrusted user input. These are sufficient factors
beyond the attacker's control.
The tomcat package shipped with Red Hat Enterprise Linux does not include log4j
but it does include a default configuration for log4j, log4j.properties, which
could be used with tomcat if users choose to install and configure the library.
The JMSAppender is not enabled by default, and the permissions of the file can
only be modified as root.
Red Hat Virtualization ships log4j12-1.2.17, but it is used and configured in a
way which makes this flaw not possible to exploit. Therefore impact is rated
Low.
MITIGATION
These are the possible mitigations for this flaw for releases version 1.x:
- Comment out or remove JMSAppender in the Log4j configuration if it is used
- Remove the JMSAppender class from the classpath. For example:
zip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class
- Restrict access for the OS user on the platform running the application to
prevent modifying the Log4j configuration by the attacker.
ADDITIONAL INFORMATION
* Bugzilla 2031667: log4j: Remote code execution in Log4j 1.x when application
is configured to use JMSAppender
* CWE-20: Improper Input Validation
* FAQ: Frequently asked questions about CVE-2021-4104
EXTERNAL REFERENCES
* https://www.cve.org/CVERecord?id=CVE-2021-4104
* https://nvd.nist.gov/vuln/detail/CVE-2021-4104
* https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
* https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
* https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
* https://www.openwall.com/lists/oss-security/2021/12/13/1
COMMON VULNERABILITY SCORING SYSTEM (CVSS) SCORE DETAILS
IMPORTANT NOTE
CVSS scores for open source components depend on vendor-specific factors (e.g.
version or build chain). Therefore, Red Hat's score and impact rating can be
different from NVD and other vendors. Red Hat remains the authoritative CVE
Naming Authority (CNA) source for its products and services (see Red Hat
classifications).
CVSS v3 Score BreakdownRed HatNVD
CVSS v3 Base Score
7.5
7.5
Attack Vector
Network
Network
Attack Complexity
High
High
Privileges Required
Low
Low
User Interaction
None
None
Scope
Unchanged
Unchanged
Confidentiality Impact
High
High
Integrity Impact
High
High
Availability Impact
High
High
CVSS V3 VECTOR
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
FREQUENTLY ASKED QUESTIONS
WHY IS RED HAT'S CVSS V3 SCORE OR IMPACT DIFFERENT FROM OTHER VENDORS?
For open source software shipped by multiple vendors, the CVSS base scores may
vary for each vendor's version depending on the version they ship, how they ship
it, the platform, and even how the software is compiled. This makes scoring of
vulnerabilities difficult for third-party vulnerability databases such as NVD
that only provide a single CVSS base score for each vulnerability. Red Hat
scores reflect how a vulnerability affects our products specifically.
For more information, see https://access.redhat.com/solutions/762393.
MY PRODUCT IS LISTED AS "UNDER INVESTIGATION" OR "AFFECTED", WHEN WILL RED HAT
RELEASE A FIX FOR THIS VULNERABILITY?
* "Under investigation" doesn't necessarily mean that the product is affected
by this vulnerability. It only means that our Analysis Team is still working
on determining whether the product is affected and how it is affected.
* "Affected" means that our Analysis Team has determined that this product is
affected by this vulnerability and might release a fix to address this in the
near future.
WHAT CAN I DO IF MY PRODUCT IS LISTED AS "WILL NOT FIX"?
This depends mostly on the Impact of the vulnerability and the Life Cycle phase
in which your product is currently in. Overall, you have the following options:
* Upgrade to a supported product version that includes a fix for this
vulnerability (recommended)
* Apply a mitigation (if one exists)
* Open a support case to request a prioritization of releasing a fix for this
vulnerability
WHAT IS A MITIGATION?
A mitigation is an action that can be taken to reduce the impact of a security
vulnerability, without deploying any fixes.
I HAVE A RED HAT PRODUCT BUT IT IS NOT IN THE ABOVE LIST, IS IT AFFECTED?
The listed products were found to include one or more of the components that
this vulnerability affects. These products underwent a thorough evaluation to
determine their affectedness by this vulnerability. Note that layered products
(such as container-based offerings) that consume affected components from any of
the products listed in this table may be affected and are not represented.
WHY IS MY SECURITY SCANNER REPORTING MY PRODUCT AS VULNERABLE TO THIS
VULNERABILITY EVEN THOUGH MY PRODUCT VERSION IS FIXED OR NOT AFFECTED?
In order to maintain code stability and compatibility, Red Hat usually does not
rebase packages to entirely new versions. Instead, we backport fixes and new
features to an older version of the package we distribute. This can result in
some security scanners that only consider the package version to report the
package as vulnerable. To avoid this, we suggest that you use an approved
vulnerability scanner from our Red Hat Vulnerability Scanner Certification
program.
MY PRODUCT IS LISTED AS "OUT OF SUPPORT SCOPE". WHAT DOES THIS MEAN?
When a product is listed as "Out of Support Scope", it means a vulnerability
with the impact level assigned to this CVE is no longer covered by its current
support lifecycle phase. The product has been identified to contain the impacted
component, but analysis to determine whether it is affected or not by this
vulnerability was not performed. The product should be assumed to be affected.
Customers are advised to apply any mitigation options documented on this page,
consider removing or disabling the impacted component, or upgrade to a supported
version of the product that has an update available.
Not sure what something means? Check out our Security Glossary.
This page is generated automatically and has not been checked for errors or
omissions.
For clarification or corrections please contact Red Hat Product Security.
Last Modified: UTC
CVE description copyright © 2021
Red Hat
QUICK LINKS
* Downloads
* Subscriptions
* Support Cases
* Customer Service
* Product Documentation
HELP
* Contact Us
* Customer Portal FAQ
* Log-in Assistance
SITE INFO
* Trust Red Hat
* Browser Support Policy
* Accessibility
* Awards and Recognition
* Colophon
RELATED SITES
* redhat.com
* developers.redhat.com
* connect.redhat.com
* cloud.redhat.com
ABOUT
* Red Hat Subscription Value
* About Red Hat
* Red Hat Jobs
All systems operational
2024
* Privacy Statement
* Terms of Use
* All Policies and Guidelines
* Cookie Preferenze
We've updated our Privacy Statement effective September 15, 2023.
Red Hat Summit
Twitter