Home > Vulnerability Database > CVE-2021-45046

Mend.io Vulnerability Database

CVE-2021-45046

Good to know:

Date: December 14, 2021

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Language: Java

Severity Score

9.0

Related Resources (29)

Url: https://security.gentoo.org/glsa/202310-16

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

Url: https://www.oracle.com/security-alerts/alert-cve-2021-44228.html

Url: https://www.oracle.com/security-alerts/cpujan2022.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

Url: https://www.cve.org/CVERecord?id=CVE-2021-44228

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-45046

Url: http://www.openwall.com/lists/oss-security/2021/12/15/1

Url: https://security.netapp.com/advisory/ntap-20211215-0001/

Url: https://www.oracle.com/security-alerts/cpuapr2022.html

Url: https://security-tracker.debian.org/tracker/CVE-2021-45046

Url: http://www.openwall.com/lists/oss-security/2021/12/18/1

Url: http://www.openwall.com/lists/oss-security/2021/12/14/4

Url: http://www.openwall.com/lists/oss-security/2021/12/15/3

Url: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html

Url: https://www.debian.org/security/2021/dsa-5022

Url: https://logging.apache.org/log4j/2.x/security.html

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2021-45046

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

Url: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

Url: https://www.oracle.com/security-alerts/cpujul2022.html

Url: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Url: https://www.kb.cert.org/vuls/id/930724

Url: https://www.mend.io/vulnerability-database/CVE-2021-45046

Severity Score

9.0

Weakness Type (CWE)

Deserialization of Untrusted Data

CWE-502

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CWE-917

Top Fix

Upgrade Version

Upgrade to version org.apache.logging.log4j:log4j-core:2.3.1,2.12.2,2.16.0;org.ops4j.pax.logging:pax-logging-log4j2:1.11.10,2.0.11

Learn More

CVSS v3.1

Base Score:	9.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	5.1
Access Vector (AV):	NETWORK
Access Complexity (AC):	HIGH
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2021-45046

Good to know:

Date: December 14, 2021

Language: Java

Severity Score

Related Resources (29)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?