CVE-2021-4104

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker’s JNDI LDAP endpoint.

Mitigation

These are the possible mitigations for this flaw for releases version 1.x:

- Comment out or remove JMSAppender in the Log4j configuration if it is used
- Remove the JMSAppender class from the classpath. For example:

zip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class  

- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.