Ubiquiti UniFi: remote code execution via bundled log4j — GLSA 202310-16

A vulnerability has been discovered in unifi where bundled log4j can facilitate a remote code execution

Affected packages

Background

Ubiquiti UniFi is a Management Controller for Ubiquiti Networks UniFi APs.

Description

A bundled version of log4j could facilitate remote code execution. Please review the CVE identifier referenced below for details.

Impact

An attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-wireless/unifi-6.5.55"
 

References

• CVE-2021-4104
• CVE-2021-45046

Release date
October 26, 2023

Latest revision
October 26, 2023: 1

Severity
high

Exploitable
remote

Bugzilla entries

• 828853