Bug 2033560 (CVE-2021-42550)

Summary:	CVE-2021-42550 logback: remote code execution through JNDI call from within its configuration file
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, akoufoud, alazarot, anstephe, bbuckingham, bcourt, bibryam, btotty, chazlett, drieden, ehelms, etirelli, ggaughan, gmalinko, hbraun, ibek, janstey, jnethert, jochrist, jrokos, jsherril, jstastny, jwon, krathod, kverlaen, lzap, mhulan, mmccune, mnovotny, myarboro, nmoumoul, orabin, pantinor, pcreech, pdelbell, pjindal, rchan, rrajasek, tzimanyi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	logback-classic-1.2.9	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the logback package. When using a specially-crafted configuration, this issue could allow a remote authenticated attacker to execute arbitrary code loaded from LDAP servers.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-29 16:02:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2034274
Bug Blocks:	2033162

Description msiddiqu 2021-12-17 09:22:08 UTC

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

https://cve.report/CVE-2021-42550
https://jira.qos.ch/browse/LOGBACK-1591

Comment 1 msiddiqu 2021-12-17 09:24:57 UTC

References: 
 
https://jira.qos.ch/browse/LOGBACK-1591

Comment 2 Yadnyawalk Tale 2021-12-20 14:44:26 UTC

Red Hat Satellite does not give write access to the logback.xml nor use scan attribute in `<configuration>` element of the configuration file; thus product is not vulnerable and mentioned exploit is not possible to perform.

Comment 13 errata-xmlrpc 2022-03-29 13:00:43 UTC

This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108

Comment 14 errata-xmlrpc 2022-03-29 13:16:49 UTC

This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110

Comment 15 Product Security DevOps Team 2022-03-29 16:02:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-42550

Comment 16 errata-xmlrpc 2022-07-05 14:27:22 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.11 for RHEL 7
  Red Hat Satellite 6.11 for RHEL 8

Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498

Comment 17 errata-xmlrpc 2022-07-07 14:21:43 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532