admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2021-12-14 12:01:11 +00:00
parent 6184c5c3f1
commit 2c3a7caf54
No known key found for this signature in database
GPG Key ID: 5708902F06FEF743
2 changed files with 28 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
2021/4xxx/CVE-2021-4104.json
View File

@ -37,7 +37,7 @@
"description_data": [
{
"lang": "eng",
"value": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. \n\nNote this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.\n\nApache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."
"value": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."
}
]
},
@ -63,19 +63,22 @@
"reference_data": [
{
"refsource": "MISC",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228",
"name": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"refsource": "CONFIRM",
"url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126"
"refsource": "MISC",
"url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
"name": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126"
},
{
"refsource": "REDHAT",
"url": "https://access.redhat.com/security/cve/CVE-2021-4104"
"refsource": "MISC",
"url": "https://access.redhat.com/security/cve/CVE-2021-4104",
"name": "https://access.redhat.com/security/cve/CVE-2021-4104"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}

18
2021/4xxx/CVE-2021-4112.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4112",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}