Read the docs
TI-2021-18835 Aliases CVE-2021-42550GHSA-668q-qrv7-99fm

RCE from attacker with configuration edit priviledges through JNDI lookup

Priority LOW 37CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Why it matters now

EPSS 0.0477 91st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial logback (QOS.ch): 1.2.9, 1.3.0-alpha11ch.qos.logback:logback-core (Maven): 1.2.9Red Hat: 4 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QOS.chlogbackbefore 1.2.9; before 1.3.0-alpha111.2.9, 1.3.0-alpha11Patch availableCNA
—ch.qos.logback:logback-core (Maven)before 1.2.91.2.9Patch availableGHSA-668q-qrv7-99fm
  • logback VendorQOS.ch Affected before 1.2.9; before 1.3.0-alpha11 Fixed in 1.2.9, 1.3.0-alpha11 Patch available CNA
  • ch.qos.logback:logback-core (Maven) Vendor— Affected before 1.2.9 Fixed in 1.2.9 Patch available GHSA-668q-qrv7-99fm

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:*up to 1.2.7VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:*1.3.0 alpha0VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:*1.3.0 alpha1VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:*1.3.0 alpha10VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:*1.3.0 alpha2VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:*1.3.0 alpha3VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:*1.3.0 alpha4VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:*1.3.0 alpha5VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:*1.3.0 alpha6VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:*1.3.0 alpha7VulnerableQos
  • cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:* Versions up to 1.2.7 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:* Versions 1.3.0 alpha0 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:* Versions 1.3.0 alpha1 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:* Versions 1.3.0 alpha10 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:* Versions 1.3.0 alpha2 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:* Versions 1.3.0 alpha3 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:* Versions 1.3.0 alpha4 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:* Versions 1.3.0 alpha5 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:* Versions 1.3.0 alpha6 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:* Versions 1.3.0 alpha7 Vulnerable ·Qos
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:*1.3.0 alpha8VulnerableQos
cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:*1.3.0 alpha9VulnerableQos
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*before 1.0.3VulnerableSiemens
  • cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:* Versions 1.3.0 alpha8 Vulnerable ·Qos
  • cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:* Versions 1.3.0 alpha9 Vulnerable ·Qos
  • cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·Siemens

Remediation

  • Fix · CNA logback (QOS.ch) Fixed in 1.2.9, 1.3.0-alpha11
  • Fix · GHSA-668q-qrv7-99fm ch.qos.logback:logback-core (Maven) Fixed in 1.2.9 Advisory →

Red Hat 4 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
  • RHSA-2022:1110 Released 2022-03-29 · Red Hat rating Moderate
    Red Hat Decision Manager 7.12.1 security update
    • RHDM 7.12.1
Show 1 more Red Hat advisories
  • RHSA-2022:1108 Released 2022-03-29 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.12.1 security update
    • RHPAM 7.12.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
RHDM 7.12.1Fixed RHSA-2022:1110
RHPAM 7.12.1Fixed RHSA-2022:1108
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2022:5498
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Not affected: 3 products
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42550
  2. 2026-10-03 Alias added: GHSA-668q-qrv7-99fm

References

Exploit 3

Advisory 5

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences