Medium severity · published Dec 18, 2021
CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
5.9
CVSS
100%
EPSS
No
On KEV
Description
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
2.0 before 2.3.1; 2.4 before 2.12.3; 2.13.0 through 2.16.0 · source: NVD
6F
6bk1602-0aa12-0tp0 Firmware · Sonicwall
before 2.7.0 · source: NVD
6F
6bk1602-0aa22-0tp0 Firmware · Sonicwall
before 2.7.0 · source: NVD
6F
6bk1602-0aa32-0tp0 Firmware · Sonicwall
before 2.7.0 · source: NVD
6F
6bk1602-0aa42-0tp0 Firmware · Sonicwall
before 2.7.0 · source: NVD
6F
6bk1602-0aa52-0tp0 Firmware · Sonicwall
before 2.7.0 · source: NVD
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Plm Mcad Connector · Oracle
3.6 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
AF
Autovue For Agile Product Lifecycle Management · Oracle
21.0.2 · source: NVD
BD
Banking Deposits And Lines OF Credit Servicing · Oracle
2.12.0 · source: NVD
BE
Banking Enterprise Default Management · Oracle
2.7.1; 2.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45105
Mailing List
http://www.openwall.com/lists/oss-security/2021/12/19/1
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
Release Notes
https://logging.apache.org/log4j/2.x/security.html
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211218-0001/
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…