log4j-1.2.17-17.0.1.el7.AXS7
エラータID: AXSA:2021-2848:01
リリース日:
2021/12/22 Wednesday - 11:52
題名:
log4j-1.2.17-17.0.1.el7.AXS7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
High
Description:
以下項目に対処しました。
[Security Fix]
- Log4j の JMSAppender には、信頼されないデータのデシリアライズに問題があり、
攻撃者が Log4j の設定で書き込み権限を持っている場合、TopicBindingName と
TopicConnectionFactoryBindingName を設定し、JMSAppender に JNDI リクエストを
実行させることで、リモートからのコード実行が可能な脆弱性があります。
なお、この問題は Log4j のバージョン 1.2 で、JMSAppender を使うように設定している
場合にのみ発生します。(CVE-2021-4104)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
追加情報:
N/A
ダウンロード:
SRPMS
- log4j-1.2.17-17.0.1.el7.AXS7.src.rpm
MD5: c68bcd11a08931f1613eee76d1005ec2
SHA-256: d000125009c9860ad51f181a4fb16f80093e4886151c3353590d47354bfce097
Size: 2.74 MB
Asianux Server 7 for x86_64
- log4j-1.2.17-17.0.1.el7.AXS7.noarch.rpm
MD5: 110d84876c6603875492d53ce50e2499
SHA-256: 458662831d0e105bb57fba2b34018486d77fc8c9403958da1b2629fbb9210643
Size: 443.51 kB
English