Vulnerability · Published Dec 18, 2021 · Assigned by apache
CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Medium 5.9
In plain English
A medium-severity improper input validation in Apache Log4j2 from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | apache-log4j2 | 2.17.0-1 | DEBIAN-CVE-2021-45105 |
| Debian:13 | apache-log4j2 | 2.17.0-1 | DEBIAN-CVE-2021-45105 |
| Debian:14 | apache-log4j2 | 2.17.0-1 | DEBIAN-CVE-2021-45105 |
| Maven | org.apache.logging.log4j:log4j-core | 2.12.3 | GHSA-p6xc-xr62-6r2g |
| Maven | org.apache.logging.log4j:log4j-core | 2.17.0 | GHSA-p6xc-xr62-6r2g |
| Maven | org.apache.logging.log4j:log4j-core | 2.3.1 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 2.0.13 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.11.12 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.10.9 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.9.2 | GHSA-p6xc-xr62-6r2g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Log4j2 | log4j-core – before 2.17.0 |
Weakness: CWE-20, CWE-674 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://logging.apache.org/log4j/2.x/security.html x_refsource_MISC
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 x_refsource_CONFIRM
- VU#930724 third-party-advisory, x_refsource_CERT-VN
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory, x_refsource_CISCO
- [oss-security] 20211218 CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation mailing-list, x_refsource_MLIST
- DSA-5024 vendor-advisory, x_refsource_DEBIAN
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20211218-0001/ x_refsource_CONFIRM
- https://www.zerodayinitiative.com/advisories/ZDI-21-1541/ x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC