PT-2023-23116 · Log4Cxx+3 · Log4Cxx+3

Robert Middleton · Published 2023-05-08 · Updated 2025-11-05 · CVE-2023-31038

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Log4cxx versions 0.9.0 through 1.1.0

Description The issue is related to SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injection. This has been the case since at least version 0.9.0. Note that Log4cxx is a C++ framework, so only C++ applications are affected. Three preconditions must be met for this vulnerability to be possible: Log4cxx compiled with ODBC support, ODBCAppender enabled for logging messages to, and user input is logged at some point.

Recommendations To resolve the issue, upgrade to version 1.1.0 which properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC connection in addition to other databases. Note that this fix does require a configuration file update, as the old configuration files will not configure properly. Update the configuration file to use the new ColumnMapping parameters, for example, change the sql value from "INSERT INTO logs (message) VALUES ('%m')" to "INSERT INTO logs (message) VALUES (?)" and add a ColumnMapping parameter with the value "message".

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2023-6275

ALT-PU-2024-15469

BDU:2025-13810

CVE-2023-31038

OPENSUSE-SU-2024:13545-1

Affected Products

Alt Linux

Debian

Log4Cxx

Red Os

References · 21

• 🔥 https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9 · Exploit
• https://errata.altlinux.org/ALT-PU-2024-15469 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31038 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13545-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31038 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-31038 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-31038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31038 · Security Note
• https://bdu.fstec.ru/vul/2025-13810 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-31038 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-6275 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-31038 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/log4cxx · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-31038 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-log4cxx-cve-2025-54812-cve-2025-54813-cve-2023-31038/?sphrase_id=1339040 · Note