Security Advisory WSO2-2021-1720¶
Published: March 08, 2022
Version: 1.0.0
Severity: Critical
CVSS Score: 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
AFFECTED PRODUCTS¶
- WSO2 Integration Studio : 8.0.0 and Below
OVERVIEW¶
Log4j remote code execution zero-day vulnerability (CVE-2021-44228) - Log4j 2.17.0 update.
DESCRIPTION¶
Security advisory contents from Apache Log4j2 is as follows [1][2]:
Apache Log4j2 <=2.14.1 JNDI features used in the configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
This upgrade cumulatively mitigates known vulnerabilities of Log4j 2 prior to 2.17.0 relevant to the following dependencies:
- log4j-core upgraded to v2.17.0
- log4j-api upgraded to v2.17.0
- log4j-jcl upgraded to v2.17.0
- pax-logging-log4j2 to v1.11.12
- org.ops4j.pax.logging.pax-logging-log4j2 to v1.11.12
IMPACT¶
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by providing a crafted payload.
SOLUTION¶
The recommended solution is to migrate the latest version of WSO2 Integration Studio which is WSO2-Integration-Studio-8.0.1.