GHSA-3w6p-8f82-gw8r Using JMSAppender in log4j configuration may lead to deserialization of untrusted data

• Maven ru.yandex.clickhouse:clickhouse-jdbc-bridge: < 2.0.7 → fixed in 2.0.7

Impact ClickHouse JDBC Bridge uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker. Patches The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`. Workarounds 1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker 2. Alternatively, you can issue below command to remove `JMSAppender.class`: ```(bash) install zip command if you don't have apt-get update && apt-get install -y zip remove the class zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class ``` References Please refer to CVE-2021-4104 to read more. For more information If you have any questions or comments about this advisory, please feel free to open an issue in the repository.