Using JMSAppender in log4j configuration may lead to deserialization of untrusted data

Summary

### Impact ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker. ### Patches The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`. ### Workarounds 1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker 2. Alternatively, you can issue below command to remove `JMSAppender.class`: ```(bash) # install zip command if you don't have apt-get update && apt-get install -y zip # remove the class zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class ``` ### References Please refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more. ### For more information If you have any questions or comments about this advisory, please feel free to open an issue in the repository.