Lucene search

K
freebsdFreeBSD650734B2-7665-4170-9A0A-EECED5E10A5E
HistoryNov 14, 2021 - 12:00 a.m.

graylog -- remote code execution in log4j from user-controlled log input

2021-11-1400:00:00
vuxml.freebsd.org
233

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.976 High

EPSS

Percentile

100.0%

Apache Software Foundation reports:

It was found that the fix to address CVE-2021-44228 in Apache
Log4j 2.15.0 was incomplete in certain non-default
configurations. This could allows attackers with control over
Thread Context Map (MDC) input data when the logging
configuration uses a non-default Pattern Layout with either a
Context Lookup (for example, $${ctx:loginId}) or a Thread
Context Map pattern (%X, %mdc, or %MDC) to craft malicious input
data using a JNDI Lookup pattern resulting in a denial of
service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt
to restrict JNDI LDAP lookups to localhost by default. Log4j
2.16.0 fixes this issue by removing support for message lookup
patterns and disabling JNDI functionality by default.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchgraylog< 4.2.4UNKNOWN

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.976 High

EPSS

Percentile

100.0%