CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.0 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 5.1 | MEDIUM | 2.0NVD | AV:N/AC:H/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due May 22, 2023
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2021-45046
- Status
- Analyzed
- Assigner (CNA)
- apache
- Published
- Dec 14, 2021
- Last modified
- 2026-06-17 04:13 UTC
- Weaknesses
- CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache Log4j1 version range
- Apache Log4j2 before 2.16.0
References
- openwall.com http://www.openwall.com/lists/oss-security/2021/12/14/4
- openwall.com http://www.openwall.com/lists/oss-security/2021/12/15/3
- openwall.com http://www.openwall.com/lists/oss-security/2021/12/18/1
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/
- logging.apache.org https://logging.apache.org/log4j/2.x/security.html
- psirt.global.sonicwall.com https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- security.gentoo.org https://security.gentoo.org/glsa/202310-16
- tools.cisco.com https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- cve.org https://www.cve.org/CVERecord?id=CVE-2021-44228
- debian.org https://www.debian.org/security/2021/dsa-5022
- intel.com https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- kb.cert.org https://www.kb.cert.org/vuls/id/930724
- oracle.com https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
- oracle.com https://www.oracle.com/security-alerts/cpujan2022.html
- oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046