NetSight
IP …
high8.6

CVE-2021-45105

Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

Impact

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.logging.log4j:log4j-core>= 2.4.0, < 2.12.32.12.3
mavenorg.ops4j.pax.logging:pax-logging-log4j2>= 1.8.0, < 1.9.21.9.2

Affected products

VendorProductAffected versions
ApacheLog4j
from 2.0 before 2.3.1
from 2.4 before 2.12.3
from 2.13.0 through 2.16.0
NetappCloud Manager
All versions
DebianDebian Linux
Versions 10.0, 11.0
SonicwallEmail Security
through 10.0.12
SonicwallNetwork Security Manager
from 2.0 before 3.0
SonicwallWeb Application Firewall
from 3.0.0 before 3.1.0
Sonicwall6bk1602-0aa12-0tp0 Firmware
before 2.7.0
Sonicwall6bk1602-0aa22-0tp0 Firmware
before 2.7.0
Sonicwall6bk1602-0aa32-0tp0 Firmware
before 2.7.0
Sonicwall6bk1602-0aa42-0tp0 Firmware
before 2.7.0
Sonicwall6bk1602-0aa52-0tp0 Firmware
before 2.7.0
OracleAgile Engineering Data Management
Version 6.2.1.0

Weakness classification

CWE-20CWE-674

References