Moderate severityNVD Advisory· Published Dec 16, 2021· Updated Aug 4, 2024
RCE from attacker with configuration edit priviledges through JNDI lookup
CVE-2021-42550
Description
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ch.qos.logback:logback-coreMaven | < 1.2.9 | 1.2.9 |
Affected products
81- ghsa-coords80 versionspkg:maven/ch.qos.logback/logback-corepkg:rpm/opensuse/antlr3-bootstrap&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/antlr3&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/antlr3-java&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/maven&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/minlog&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/sbt-bootstrap&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/sbt&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/xmvn-connector&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/xmvn&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/xmvn-mojo&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/xmvn-parent&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/xmvn-tools&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/antlr3-java&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/maven&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/maven&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/minlog&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/minlog&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/xmvn-connector&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/xmvn-connector&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/xmvn&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/xmvn&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/xmvn-tools&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/xmvn-tools&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3
< 1.2.9+ 79 more
- (no CPE)range: < 1.2.9
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 0.13.18-150200.4.7.8
- (no CPE)range: < 0.13.18-150200.4.7.8
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- QOS.ch/logbackv5Range: unspecified
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-668q-qrv7-99fmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-42550ghsaADVISORY
- logback.qos.ch/news.htmlghsaWEB
- packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlghsaWEB
- seclists.org/fulldisclosure/2022/Jul/11ghsamailing-listWEB
- cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfghsaWEB
- github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.htmlghsaWEB
- github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359cghsaWEB
- github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42ghsaWEB
- jira.qos.ch/browse/LOGBACK-1591ghsaWEB
- security.netapp.com/advisory/ntap-20211229-0001ghsaWEB
- security.netapp.com/advisory/ntap-20211229-0001/mitre
News mentions
0No linked articles in our index yet.