CVE-2021-45105
⚪ Do wiadomości
Niechronione rekurencje w Apache Log4j2 mogą prowadzić do odmowy usługi.
CVSS
5.9
EPSS
74.5%
Exploit
none
Vendor
oracle
Opis źródłowy (NVD)
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
dos
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.9 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 74.5% |
| Opublikowano (NVD) | 2021-12-18 12:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2026-05-29 13:16:19 UTC |
Referencje
- http://www.openwall.com/lists/oss-security/2021/12/19/1 (security@apache.org) [Mailing List, Mitigation, Third Party Advisory]
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf (security@apache.org) [Third Party Advisory]
- https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf (security@apache.org) [Third Party Advisory]
- https://logging.apache.org/log4j/2.x/security.html (security@apache.org) [Release Notes, Vendor Advisory]
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 (security@apache.org) [Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20211218-0001/ (security@apache.org) [Third Party Advisory]
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd (security@apache.org) [Third Party Advisory]
- https://www.debian.org/security/2021/dsa-5024 (security@apache.org) [Third Party Advisory]
- https://www.kb.cert.org/vuls/id/930724 (security@apache.org) [Third Party Advisory, US Government Resource]
- https://www.oracle.com/security-alerts/cpuapr2022.html (security@apache.org) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujan2022.html (security@apache.org) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujul2022.html (security@apache.org) [Third Party Advisory]
- https://www.zerodayinitiative.com/advisories/ZDI-21-1541/ (security@apache.org) [Third Party Advisory, VDB Entry]