Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-3w6p-8f82-gw8r
No affected components available
Impact
ClickHouse JDBC Bridge uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.
Patches
The patch version 2.0.7 removed log4j dependency by replacing slf4j-log4j12 to slf4j-jdk14. Logging configuration is also changed from log4j.properties to logging.properties.
Workarounds
- Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
- Alternatively, you can issue below command to remove
JMSAppender.class:
# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class
References
Please refer to CVE-2021-4104 to read more.
For more information
If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard