CVE-2021-45046 Information

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example $$ctx:loginId) or a Thread Context Map pattern (%X %mdc or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Reference

http://www.openwall.com/lists/oss-security/2021/12/14/4 https://logging.apache.org/log4j/2.x/security.html https://www.cve.org/CVERecord?id=CVE-2021-44228 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd http://www.openwall.com/lists/oss-security/2021/12/15/3 https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf https://www.kb.cert.org/vuls/id/930724 https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf https://www.debian.org/security/2021/dsa-5022 https://www.oracle.com/security-alerts/alert-cve-2021-44228.html https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 http://www.openwall.com/lists/oss-security/2021/12/18/1 https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuapr2022.html

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.0