CVE-2021-45105 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
An attacker controlling Thread Context Map data can cause a denial of service via infinite recursion in Log4j2 lookup evaluation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45105?
CVE-2021-45105 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 18 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Which versions are affected by CVE-2021-45105?
14 open source packages ship an affected version, including org.ops4j.pax.logging:pax-logging-log4j2 and org.apache.logging.log4j:log4j-core. It affects 116 products.
| Package | Affected | Fixed in |
|---|---|---|
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.10.0 | 1.10.9 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.10.0 | 1.10.9 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.11.0 | 1.11.12 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.11.0 | 1.11.12 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.8.0 | 1.9.2 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 1.8.0 | 1.9.2 |
8 more packages
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.13 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.13 |
org.apache.logging.log4j:log4j-core Maven | All versions | 2.3.1 |
org.apache.logging.log4j:log4j-core Maven | All versions | 2.3.1 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.17.0 |
org.apache.logging.log4j:log4j-core Maven | From 2.13.0 | 2.17.0 |
org.apache.logging.log4j:log4j-core Maven | From 2.4.0 | 2.12.3 |
org.apache.logging.log4j:log4j-core Maven | From 2.4.0 | 2.12.3 |
Linux distribution packages (6)
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.5::el7 | All versions | 0:15.0.6-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.5::el7 | All versions | 0:15.0.6-1.redhat_00001.1.el7sso |
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.5::el8 | All versions | 0:15.0.6-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.5::el8 | All versions | 0:15.0.6-1.redhat_00001.1.el8sso |
log4j openSUSE:Leap 15.2 | All versions | 2.17.0-lp152.3.12.1 |
log4j openSUSE:Leap 15.3 | All versions | 2.17.0-4.13.1 |
Products include Apache Log4j, Debian Debian Linux, Netapp Cloud Manager, Oracle Agile Engineering Data Management, Oracle Agile Plm Mcad Connector, Oracle Agile Product Lifecycle Management and 110 more.
How do I fix CVE-2021-45105?
Upgrade org.ops4j.pax.logging:pax-logging-log4j2 to a fixed version for your release line: 1.10.9, 1.11.12, 1.9.2 or 2.0.13.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-45105 being exploited?
There is no known exploitation of CVE-2021-45105 in the wild and no public exploit code.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2021-44228 Apache Log4j2 Remote Code Execution
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data
- CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1
- CVE-2017-5645 Deserialization of Untrusted Data in Log4j
- CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
Sources
Also known as DEBIAN-CVE-2021-45105, DSA-5024-1, GHSA-p6xc-xr62-6r2g, MGASA-2021-0572, MINI-24mm-f3g3-p5hx, RHSA-2022:1462 and 7 more.