CVEvulnerability

CVE-2021-45105

5.9 MEDIUM Published 2021-12-18 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2021-12-18
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20, CWE-674

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected configurations

• apache log4j (>= 2.0 < 2.3.1) • apache log4j (>= 2.4 < 2.12.3) • apache log4j (>= 2.13.0 <= 2.16.0) • netapp cloud manager • debian debian linux 10.0 • debian debian linux 11.0 • sonicwall email security (<= 10.0.12) • sonicwall network security manager (>= 2.0 < 3.0) • sonicwall web application firewall (>= 3.0.0 < 3.1.0) • sonicwall 6bk1602-0aa12-0tp0 firmware (< 2.7.0) • sonicwall 6bk1602-0aa22-0tp0 firmware (< 2.7.0) • sonicwall 6bk1602-0aa32-0tp0 firmware (< 2.7.0) • sonicwall 6bk1602-0aa42-0tp0 firmware (< 2.7.0) • sonicwall 6bk1602-0aa52-0tp0 firmware (< 2.7.0) • oracle agile engineering data management 6.2.1.0 • oracle agile plm mcad connector 3.6 • oracle agile product lifecycle management 9.3.6 • oracle autovue for agile product lifecycle management 21.0.2 • oracle banking deposits and lines of credit servicing 2.12.0 • oracle banking enterprise default management 2.7.1 • oracle banking enterprise default management 2.12.0 • oracle banking loans servicing 2.12.0 • oracle banking party management 2.7.0 • oracle banking payments 14.5 • oracle banking platform 2.6.2 • oracle banking platform 2.7.1 • oracle banking platform 2.12.0 • oracle banking trade finance 14.5 • oracle banking treasury management 14.5 • oracle business intelligence 5.5.0.0.0 • oracle communications asap 7.3 • oracle communications billing and revenue management 12.0.0.4 • oracle communications billing and revenue management 12.0.0.5 • oracle communications cloud native core console 1.9.0 • oracle communications cloud native core network function cloud native environment 1.10.0 • oracle communications cloud native core network repository function 1.15.0 • oracle communications cloud native core network repository function 1.15.1 • oracle communications cloud native core network slice selection function 1.8.0 • oracle communications cloud native core policy 1.15.0 • oracle communications cloud native core security edge protection proxy 1.7.0 • oracle communications cloud native core service communication proxy 1.15.0 • oracle communications cloud native core unified data repository 1.15.0 • oracle communications convergence 3.0.2.2.0 • oracle communications convergence 3.0.3.0 • oracle communications convergent charging controller (>= 12.0.1.0.0 <= 12.0.4.0.0) • oracle communications convergent charging controller 6.0.1.0.0 • oracle communications diameter signaling router (>= 8.3.0.0 <= 8.5.1.0) • oracle communications eagle element management system 46.6 • oracle communications eagle ftp table base retrieval 4.5 • oracle communications element manager (< 9.0) • oracle communications evolved communications application server 7.1 • oracle communications interactive session recorder 6.3 • oracle communications interactive session recorder 6.4 • oracle communications ip service activator 7.4.0 • oracle communications messaging server 8.1 • oracle communications network charging and control (>= 12.0.1.0.0 <= 12.0.4.0.0) • oracle communications network charging and control 6.0.1.0.0 • oracle communications network integrity 7.3.6 • oracle communications performance intelligence center 10.4.0.3 • oracle communications pricing design center 12.0.0.4 … and 147 more

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-674 Uncontrolled Recursion weakness

References