Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zdzZwLThmODItZ3c4cs0c1Q

Using JMSAppender in log4j configuration may lead to deserialization of untrusted data

Impact

ClickHouse JDBC Bridge uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.

Patches

The patch version 2.0.7 removed log4j dependency by replacing slf4j-log4j12 to slf4j-jdk14. Logging configuration is also changed from log4j.properties to logging.properties.

Workarounds

1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
2. Alternatively, you can issue below command to remove JMSAppender.class:

# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class

References

Please refer to CVE-2021-4104 to read more.

For more information

If you have any questions or comments about this advisory, please feel free to open an issue in the repository.

Permalink: https://github.com/advisories/GHSA-3w6p-8f82-gw8r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zdzZwLThmODItZ3c4cs0c1Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 3 years ago
Updated: almost 2 years ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3w6p-8f82-gw8r
References:

• https://github.com/ClickHouse/clickhouse-jdbc-bridge/security/advisories/GHSA-3w6p-8f82-gw8r
• https://nvd.nist.gov/vuln/detail/CVE-2021-4104
• https://access.redhat.com/security/cve/CVE-2021-4104
• https://github.com/advisories/GHSA-3w6p-8f82-gw8r

Repository: https://github.com/ClickHouse/clickhouse-jdbc-bridge
Blast Radius: 1.0

Affected Packages