Loading HuntDB...

CVE-2021-45105

UNKNOWN
Published 2021-12-18T11:55:08
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2021-45105. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Understanding This Vulnerability

This Common Vulnerabilities and Exposures (CVE) entry provides detailed information about a security vulnerability that has been publicly disclosed. CVEs are standardized identifiers assigned by MITRE Corporation to track and catalog security vulnerabilities across software and hardware products.

The severity rating (UNKNOWN) indicates the potential impact of this vulnerability based on the CVSS (Common Vulnerability Scoring System) framework. Higher severity ratings typically indicate vulnerabilities that could lead to more significant security breaches if exploited. Security teams should prioritize remediation efforts based on severity, exploit availability, and the EPSS (Exploit Prediction Scoring System) score, which predicts the likelihood of exploitation in the wild.

If this vulnerability affects products or systems in your infrastructure, we recommend reviewing the affected products section, checking for available patches or updates from vendors, and implementing recommended workarounds or solutions until a permanent fix is available. Organizations should also monitor security advisories and threat intelligence feeds for updates about active exploitation of this vulnerability.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

References

Workarounds

Implement one of the following mitigation techniques:

* Java 8 (or later) users should upgrade to release 2.17.0.

Alternatively, this can be mitigated in configuration:

* In PatternLayout in the logging configuration, replace Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` with Thread Context Map patterns (%X, %mdc, or %MDC).
* Otherwise, in the configuration, remove references to Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` where they originate
from sources external to the application such as HTTP headers or user input.

Credits & Acknowledgments

Independently discovered by Hideki Okamoto of Akamai Technologies, Guy Lederfein of Trend Micro Research working with Trend Micro’s Zero Day Initiative, and another anonymous vulnerability researcher

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

GHSA-p6xc-xr62-6r2g

Advisory Details

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

Affected Packages

Maven org.apache.logging.log4j:log4j-core
ECOSYSTEM: ≥2.4.0 <2.12.3
Maven org.apache.logging.log4j:log4j-core
ECOSYSTEM: ≥2.13.0 <2.17.0
Maven org.apache.logging.log4j:log4j-core
ECOSYSTEM: ≥0 <2.3.1
Maven org.ops4j.pax.logging:pax-logging-log4j2
ECOSYSTEM: ≥1.8.0 <1.9.2
Maven org.ops4j.pax.logging:pax-logging-log4j2
ECOSYSTEM: ≥1.10.0 <1.10.9
Maven org.ops4j.pax.logging:pax-logging-log4j2
ECOSYSTEM: ≥1.11.0 <1.11.12
Maven org.ops4j.pax.logging:pax-logging-log4j2
ECOSYSTEM: ≥2.0.0 <2.0.13

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Advisory provided by GitHub Security Advisory Database. Published: December 18, 2021, Modified: May 9, 2025

References

Published: 2021-12-18T11:55:08
Last Modified: 2024-08-04T04:39:20.295Z
Copied to clipboard!