CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data

What is CVE-2021-45046?

CVE-2021-45046 is a critical code injection vulnerability in Debian Debian Linux, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Weakness: CWE-917

Which versions are affected by CVE-2021-45046?

14 open source packages ship an affected version, including org.ops4j.pax.logging:pax-logging-log4j2 and org.apache.logging.log4j:log4j-core. It affects 55 products.

Products include Apache Log4j, Cvat Computer Vision Annotation Tool, Debian Debian Linux, Fedoraproject Fedora, Intel Audio Development Kit, Intel Datacenter Manager and 49 more.

How do I fix CVE-2021-45046?

Upgrade org.ops4j.pax.logging:pax-logging-log4j2 to a fixed version for your release line: 1.10.8, 1.11.11, 1.9.2 or 2.0.12. US federal agencies must fix it by 22 May 2023.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-45046 being exploited?

Yes. Attackers have exploited CVE-2021-45046 in the wild since at least 1 May 2023, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 11 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2021-44228 Apache Log4j2 Remote Code Execution Exploited Critical 10.0
• CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1 Critical 9.8
• CVE-2017-5645 Deserialization of Untrusted Data in Log4j Critical 9.8
• CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x High 8.8
• CVE-2023-26464 Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-45046, DSA-5022-1, GHSA-7rjr-3q55-vv33, MGASA-2021-0566, MINI-x4gq-qjph-q7m9, OESA-2021-1467 and 1 more.