CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
- Affected products
- Apache Log4J2, Apache Struts, Astra Linux, Linuxmint, Red Os, Suse, Ubuntu
- Apache log4j
- < 2.3.1, 2.12.3, 2.16.0
- Fix
- Available
- CVSS 3.1
- 5.9 MEDIUM
- EPSS
- 100.0% (100th percentile)
- Weakness
- CWE-20, CWE-674
- NVD status
- Modified
- Published
- 2021-12-18
Workaround
Implement one of the following mitigation techniques: * Java 8 (or later) users should upgrade to release 2.17.0. Alternatively, this can be mitigated in configuration: * In PatternLayout in the logging configuration, replace Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` with Thread Context Map patterns (%X, %mdc, or %MDC). * Otherwise, in the configuration, remove references to Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` where they originate from sources external to the application such as HTTP headers or user input.
36 known exploits for CVE-2021-45105
Proof-of-concept code and exploit modules indexed by Sploitus