Vulnerability · Published Dec 16, 2021 · Assigned by NCSC.ch
CVE-2021-42550RCE from attacker with configuration edit priviledges through JNDI lookup
Medium 6.6
In plain English
A medium-severity unsafe deserialization in logback from QOS.ch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)4.8%top 8.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | logback | 1:1.2.8-1 | DEBIAN-CVE-2021-42550 |
| Debian:13 | logback | 1:1.2.8-1 | DEBIAN-CVE-2021-42550 |
| Debian:14 | logback | 1:1.2.8-1 | DEBIAN-CVE-2021-42550 |
| Maven | ch.qos.logback:logback-core | 1.2.9 | GHSA-668q-qrv7-99fm |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:5498 |
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://logback.qos.ch/news.html
- https://github.com/cn-panda/logbackRceDemo
- https://jira.qos.ch/browse/LOGBACK-1591
- https://security.netapp.com/advisory/ntap-20211229-0001/
- 20220721 Open-Xchange Security Advisory 2022-07-21 mailing-list
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf