CVE-2021-45105

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CVSS breakdown

Affected products

• apache / log4j2.0 – 2.3.1
• Apache Software Foundation / Apache Log4j2log4j-core – 2.17.0
• debian / debian_linux10.0 – 10.0
• debian / debian_linux11.0 – 11.0
• NETAPP / cloud_manager
• oracle / agile_engineering_data_management6.2.1.0 – 6.2.1.0
• oracle / agile_plm_mcad_connector3.6 – 3.6
• oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
• oracle / autovue_for_agile_product_lifecycle_management21.0.2 – 21.0.2
• oracle / banking_deposits_and_lines_of_credit_servicing2.12.0 – 2.12.0
• oracle / banking_enterprise_default_management2.7.1 – 2.7.1
• oracle / banking_enterprise_default_management2.12.0 – 2.12.0
• oracle / banking_loans_servicing2.12.0 – 2.12.0
• oracle / banking_party_management2.7.0 – 2.7.0
• oracle / banking_payments14.5 – 14.5
• oracle / banking_platform2.7.1 – 2.7.1
• oracle / banking_platform2.12.0 – 2.12.0
• oracle / banking_platform2.6.2 – 2.6.2
• oracle / banking_trade_finance14.5 – 14.5
• oracle / banking_treasury_management14.5 – 14.5
• oracle / business_intelligence5.5.0.0.0 – 5.5.0.0.0
• oracle / communications_asap7.3 – 7.3
• oracle / communications_billing_and_revenue_management12.0.0.4 – 12.0.0.4
• oracle / communications_billing_and_revenue_management12.0.0.5 – 12.0.0.5
• oracle / communications_cloud_native_core_console1.9.0 – 1.9.0
• oracle / communications_cloud_native_core_network_function_cloud_native_environment1.10.0 – 1.10.0
• oracle / communications_cloud_native_core_network_repository_function1.15.1 – 1.15.1
• oracle / communications_cloud_native_core_network_repository_function1.15.0 – 1.15.0
• oracle / communications_cloud_native_core_network_slice_selection_function1.8.0 – 1.8.0
• oracle / communications_cloud_native_core_policy1.15.0 – 1.15.0
• oracle / communications_cloud_native_core_security_edge_protection_proxy1.7.0 – 1.7.0
• oracle / communications_cloud_native_core_service_communication_proxy1.15.0 – 1.15.0
• oracle / communications_cloud_native_core_unified_data_repository1.15.0 – 1.15.0
• oracle / communications_convergence3.0.3.0 – 3.0.3.0
• oracle / communications_convergence3.0.2.2.0 – 3.0.2.2.0
• oracle / communications_convergent_charging_controller6.0.1.0.0 – 6.0.1.0.0
• oracle / communications_convergent_charging_controller12.0.1.0.0 – 12.0.4.0.0
• oracle / communications_diameter_signaling_router8.3.0.0 – 8.5.1.0
• oracle / communications_eagle_element_management_system46.6 – 46.6
• oracle / communications_eagle_ftp_table_base_retrieval4.5 – 4.5
• oracle / communications_element_manager9.0
• oracle / communications_evolved_communications_application_server7.1 – 7.1
• oracle / communications_interactive_session_recorder6.3 – 6.3
• oracle / communications_interactive_session_recorder6.4 – 6.4
• oracle / communications_ip_service_activator7.4.0 – 7.4.0
• oracle / communications_messaging_server8.1 – 8.1
• oracle / communications_network_charging_and_control6.0.1.0.0 – 6.0.1.0.0
• oracle / communications_network_charging_and_control12.0.1.0.0 – 12.0.4.0.0
• oracle / communications_network_integrity7.3.6 – 7.3.6
• oracle / communications_performance_intelligence_center10.4.0.3 – 10.4.0.3
• oracle / communications_pricing_design_center12.0.0.5 – 12.0.0.5
• oracle / communications_pricing_design_center12.0.0.4 – 12.0.0.4
• oracle / communications_service_broker6.2 – 6.2
• oracle / communications_services_gatekeeper7.0 – 7.0
• oracle / communications_session_report_manager9.0
• oracle / communications_session_route_manager9.0
• oracle / communications_unified_inventory_management7.4.1 – 7.4.1
• oracle / communications_unified_inventory_management7.4.2 – 7.4.2
• oracle / communications_unified_inventory_management7.3.5 – 7.3.5
• oracle / communications_user_data_repository12.4 – 12.4
• oracle / communications_webrtc_session_controller7.2.0.0 – 7.2.0.0
• oracle / communications_webrtc_session_controller7.2.1 – 7.2.1
• oracle / data_integrator12.2.1.3.0 – 12.2.1.3.0
• oracle / data_integrator12.2.1.4.0 – 12.2.1.4.0
• oracle / e-business_suite12.2 – 12.2
• oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
• oracle / enterprise_manager_base_platform13.5.0.0 – 13.5.0.0
• oracle / enterprise_manager_for_peoplesoft13.4.1.1 – 13.4.1.1
• oracle / enterprise_manager_for_peoplesoft13.5.1.1 – 13.5.1.1
• oracle / enterprise_manager_ops_center12.4.0.0 – 12.4.0.0
• oracle / financial_services_analytical_applications_infrastructure8.0.7 – 8.1.1
• oracle / financial_services_model_management_and_governance8.0.8.0.0 – 8.0.8.0.0
• oracle / financial_services_model_management_and_governance8.1.1.0.0 – 8.1.1.0.0
• oracle / financial_services_model_management_and_governance8.1.0.0.0 – 8.1.0.0.0
• oracle / FLEXCUBE Universal Banking14.5 – 14.5
• oracle / FLEXCUBE Universal Banking11.83.3 – 11.83.3
• oracle / FLEXCUBE Universal Banking12.1.0 – 12.4
• oracle / healthcare_data_repository8.1.1 – 8.1.1
• oracle / healthcare_foundation7.3.0.1 – 7.3.0.4
• oracle / healthcare_master_person_index5.0.1 – 5.0.1
• oracle / healthcare_translational_research4.1.1 – 4.1.1
• oracle / healthcare_translational_research4.1.0 – 4.1.0
• oracle / health_sciences_empirica_signal9.2.0.0 – 9.2.0.0
• oracle / health_sciences_empirica_signal9.1.0.6 – 9.1.0.6
• oracle / health_sciences_inform7.0.0.0 – 7.0.0.0
• oracle / health_sciences_inform6.2.1.1 – 6.2.1.1
• oracle / health_sciences_inform6.3.2.1 – 6.3.2.1
• oracle / health_sciences_information_manager3.0.1 – 3.0.4
• oracle / hospitality_suite88.13.0 – 8.13.0
• oracle / hospitality_suite88.14.0 – 8.14.0
• oracle / hospitality_token_proxy_service19.2 – 19.2
• oracle / hyperion_bi+11.2.8.0
• oracle / hyperion_data_relationship_management11.2.8.0
• oracle / hyperion_infrastructure_technology11.2.8.0
• oracle / hyperion_planning11.2.8.0
• oracle / hyperion_profitability_and_cost_management11.2.8.0
• oracle / hyperion_tax_provision11.2.8.0
• oracle / identity_management_suite12.2.1.3.0 – 12.2.1.3.0
• oracle / identity_management_suite12.2.1.4.0 – 12.2.1.4.0
• oracle / identity_manager_connector9.1.0 – 9.1.0
• oracle / instantis_enterprisetrack17.1 – 17.1
• oracle / instantis_enterprisetrack17.3 – 17.3
• oracle / instantis_enterprisetrack17.2 – 17.2
• oracle / insurance_data_gateway1.0.1 – 1.0.1
• oracle / insurance_insbridge_rating_and_underwriting5.2.0 – 5.2.0
• oracle / insurance_insbridge_rating_and_underwriting5.6.1.0 – 5.6.1.0
• oracle / insurance_insbridge_rating_and_underwriting5.4 – 5.6.0.0
• oracle / JDeveloper12.2.1.4.0 – 12.2.1.4.0
• oracle / managed_file_transfer12.2.1.4.0 – 12.2.1.4.0
• oracle / managed_file_transfer12.2.1.3.0 – 12.2.1.3.0
• oracle / management_cloud_engine1.5.0 – 1.5.0
• oracle / MySQL Enterprise Monitor8.0.29
• oracle / payment_interface20.3 – 20.3
• oracle / payment_interface19.1 – 19.1
• oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / primavera_gateway17.12.0 – 17.12.11
• oracle / primavera_gateway21.12.0 – 21.12.0
• oracle / primavera_p6_enterprise_project_portfolio_management19.12.0.0 – 19.12.18.0
• oracle / primavera_p6_enterprise_project_portfolio_management21.12.0.0 – 21.12.0.0
• oracle / primavera_unifier19.12 – 19.12
• oracle / primavera_unifier18.8 – 18.8
• oracle / primavera_unifier20.12 – 20.12
• oracle / primavera_unifier21.12 – 21.12
• oracle / retail_back_office14.1 – 14.1
• oracle / retail_central_office14.1 – 14.1
• oracle / retail_customer_insights16.0.2 – 16.0.2
• oracle / retail_customer_insights15.0.2 – 15.0.2
• oracle / retail_data_extractor_for_merchandising15.0.2 – 15.0.2
• oracle / retail_data_extractor_for_merchandising16.0.2 – 16.0.2
• oracle / retail_eftlink16.0.3 – 16.0.3
• oracle / retail_eftlink18.0.1 – 18.0.1
• oracle / retail_eftlink19.0.1 – 19.0.1
• oracle / retail_eftlink20.0.1 – 20.0.1
• oracle / retail_eftlink21.0.0 – 21.0.0
• oracle / retail_eftlink17.0.2 – 17.0.2
• oracle / retail_financial_integration14.1.3.2 – 14.1.3.2
• oracle / retail_financial_integration16.0.1 – 16.0.3
• oracle / retail_financial_integration15.0.3.1 – 15.0.3.1
• oracle / retail_financial_integration19.0.0 – 19.0.0
• oracle / retail_financial_integration19.0.1 – 19.0.1
• oracle / retail_integration_bus19.0.1 – 19.0.1
• oracle / retail_integration_bus16.0.1 – 16.0.3
• oracle / retail_integration_bus14.1.3 – 14.1.3
• oracle / retail_integration_bus14.1.3.2 – 14.1.3.2
• oracle / retail_integration_bus15.0.3.1 – 15.0.3.1
• oracle / retail_integration_bus19.0.0 – 19.0.0
• oracle / retail_invoice_matching15.0.3 – 15.0.3
• oracle / retail_invoice_matching16.0.3 – 16.0.3
• oracle / retail_merchandising_system16.0.3 – 16.0.3
• oracle / retail_merchandising_system19.0.1 – 19.0.1
• oracle / retail_order_broker19.1 – 19.1
• oracle / retail_order_broker18.0 – 18.0
• oracle / retail_order_broker16.0 – 16.0
• oracle / retail_order_management_system19.5 – 19.5
• oracle / retail_point-of-service14.1 – 14.1
• oracle / retail_predictive_application_server15.0.3.115 – 15.0.3.115
• oracle / retail_predictive_application_server16.0.3.240 – 16.0.3.240
• oracle / retail_predictive_application_server14.1.3.46 – 14.1.3.46
• oracle / retail_price_management14.0.4 – 14.0.4
• oracle / retail_price_management14.1.3.0 – 14.1.3.0
• oracle / retail_price_management15.0.3.0 – 15.0.3.0
• oracle / retail_price_management16.0.3.0 – 16.0.3.0
• oracle / retail_price_management13.2 – 13.2
• oracle / retail_returns_management14.1 – 14.1
• oracle / retail_service_backbone19.0.1.0 – 19.0.1.0
• oracle / retail_service_backbone16.0.1 – 16.0.3
• oracle / retail_service_backbone14.1.3 – 14.1.3
• oracle / retail_service_backbone14.1.3.2 – 14.1.3.2
• oracle / retail_service_backbone15.0.3.1 – 15.0.3.1
• oracle / retail_service_backbone19.0.0 – 19.0.0
• oracle / retail_service_backbone19.0.1 – 19.0.1
• oracle / retail_store_inventory_management15.0.3.8 – 15.0.3.8
• oracle / retail_store_inventory_management16.0.3.7 – 16.0.3.7
• oracle / retail_store_inventory_management14.0.4.13 – 14.0.4.13
• oracle / retail_store_inventory_management14.1.3.5 – 14.1.3.5
• oracle / retail_store_inventory_management14.1.3.14 – 14.1.3.14
• oracle / retail_store_inventory_management15.0.3.3 – 15.0.3.3
• oracle / Siebel UI Framework21.12
• oracle / sql_developer21.4.2
• oracle / taleo_platform22.1
• oracle / utilities_framework4.4.0.3.0 – 4.4.0.3.0
• oracle / utilities_framework4.3.0.1.0 – 4.3.0.6.0
• oracle / utilities_framework4.4.0.0.0 – 4.4.0.0.0
• oracle / utilities_framework4.4.0.2.0 – 4.4.0.2.0
• oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
• oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
• oracle / webcenter_sites12.2.1.4.0 – 12.2.1.4.0
• oracle / webcenter_sites12.2.1.3.0 – 12.2.1.3.0
• oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
• oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
• oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
• SonicWall / 6bk1602-0aa12-0tp0_firmware2.7.0
• SonicWall / 6bk1602-0aa22-0tp0_firmware2.7.0
• SonicWall / 6bk1602-0aa32-0tp0_firmware2.7.0
• SonicWall / 6bk1602-0aa42-0tp0_firmware2.7.0
• SonicWall / 6bk1602-0aa52-0tp0_firmware2.7.0
• SonicWall / Email Security10.0.12
• SonicWall / network_security_manager2.0 – 3.0
• SonicWall / network_security_manager2.0 – 3.0
• SonicWall / web_application_firewall3.0.0 – 3.1.0

References

• MISChttps://logging.apache.org/log4j/2.x/security.html
• VENDOR_ADVISORYhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• MISChttps://www.kb.cert.org/vuls/id/930724
• VENDOR_ADVISORYhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2021/12/19/1
• VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-5024
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
• MISChttps://security.netapp.com/advisory/ntap-20211218-0001/
• VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1541/
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html