CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

• CWE-502
• CWE-502

• http://www.openwall.com/lists/oss-security/2022/01/18/3
• https://access.redhat.com/security/cve/CVE-2021-4104
• https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
• https://security.gentoo.org/glsa/202209-02
• https://security.gentoo.org/glsa/202310-16
• https://security.gentoo.org/glsa/202312-02
• https://security.gentoo.org/glsa/202312-04
• https://security.netapp.com/advisory/ntap-20211223-0007/
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://www.kb.cert.org/vuls/id/930724
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• http://www.openwall.com/lists/oss-security/2022/01/18/3
• https://access.redhat.com/security/cve/CVE-2021-4104
• https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
• https://security.gentoo.org/glsa/202209-02
• https://security.gentoo.org/glsa/202310-16
• https://security.gentoo.org/glsa/202312-02
• https://security.gentoo.org/glsa/202312-04
• https://security.netapp.com/advisory/ntap-20211223-0007/
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://www.kb.cert.org/vuls/id/930724
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Published

Dec 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41034The build of some language stacks of Eclipse Che version 6 i…8.1
• CVE-2021-41035In Eclipse Openj9 before version 0.29.0, the JVM does not th…9.8
• CVE-2021-41036In versions prior to 1.1 of the Eclipse Paho MQTT C Client, …9.8
• CVE-2021-41037In Eclipse p2, installable units are able to alter the Eclip…8
• CVE-2021-41038In versions of the @theia/plugin-ext component of Eclipse Th…6.1
• CVE-2021-41039In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 c…7.5
• CVE-2021-41040In Eclipse Wakaama, ever since its inception until 2021-01-1…7.5
• CVE-2021-41041In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to…5.3
• CVE-2021-41042In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory…5.3
• CVE-2021-41043Use after free in tcpslice triggers AddressSanitizer, no oth…5.5
• CVE-2021-4105Improper Handling of Parameters vulnerability in BG-TEK COSL…9.8
• CVE-2021-41054tftpd_file.c in atftp through 0.7.4 has a buffer overflow be…7.5