Critical severity · published Dec 14, 2021
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
RansomwareIn wildKEV
9.0
CVSS
100%
EPSS
Yes
On KEV
Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 1, 2023
Federal remediation dueMay 22, 2023
Ransomware campaign useKnown
Affected products
Which versions
LO
Log4j · Apache
Apache Log4j2 before 2.16.0 · source: vendor, NVD, KEV
6F
6bk1602-0aa12-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa22-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa32-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa42-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa52-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
AD
Audio Development Kit · Intel
All versions, or not specified · source: NVD
CA
Captial · Siemens
before 2019.1; 2019.1; 2019.1 · source: NVD
CO
Comos · Siemens
All versions, or not specified · source: NVD
CV
Computer Vision Annotation Tool · Cvat
All versions, or not specified · source: NVD
DM
Datacenter Manager · Intel
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45046
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
x_refsource_CONFIRM
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
x_refsource_MISC
https://www.cve.org/CVERecord?id=CVE-2021-44228
mailing-list
http://www.openwall.com/lists/oss-security/2021/12/14/4
x_refsource_CONFIRM
https://logging.apache.org/log4j/2.x/security.html
third-party-advisory
https://www.kb.cert.org/vuls/id/930724
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…