NewsSiemens ProductCERT

    SSA-784507 V1.0: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products

    Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) contain a vulnerability (CVE-2021-44832) that could allow an attacker with permission to modify the logging configuration file to execute arbitrary code, when the JDBC Appender is used [1]. This advisory informs about the impact of CVE-2021-44832 to Siemens products and the corresponding remediation and mitigation measures. The vulnerability is different from other JNDI lookup vulnerabilities, the impact of which is documented in SSA-661247 [2]. Currently, no products vulnerable to CVE-2021-44832 have been identified. Siemens is investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. [1] https://logging.apache.org/log4j/2.x/security.html [2] https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

    Linked advisories

    Affected vendors and products

    More on SSA-784507

    Other advisories

    Source: https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf

    ID