CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Impact
The fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack.
Affected packages Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.
Mitigation
Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.formatMsgNoLookups to true do NOT mitigate this specific vulnerability.
Other sources
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
— CISA
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability.
Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Reference: https://www.openwall.com/lists/oss-security/2021/12/14/4
— Red Hat
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.16.0-1Fixed in 2.16.0-1~deb11u1Fixed in 2.16.0-1~deb10u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.1-1~deb10u1Fixed in 2.17.0-1~deb10u1Fixed in 2.17.1-1~deb11u1Fixed in 2.17.0-1~deb11u1Fixed in 2.19.0-2 - Upgrade
Upgrade
redhat/eap7-log4jto a version that resolves this vulnerability.Fixed in 0:2.17.1-1.redhat_00001.1.el8ea - Upgrade
Upgrade
redhat/eap7-log4jto a version that resolves this vulnerability.Fixed in 0:2.17.1-1.redhat_00001.1.el7ea - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 2.0.12 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.10.8 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.9.2 - Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.12.2 - Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
redhat/log4jto a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.16.0-1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.16.0-1~deb11u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.16.0-1~deb10u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.1-1~deb10u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.0-1~deb10u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.1-1~deb11u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.0-1~deb11u1 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.19.0-2 - Configuration
For Log4j versions up to and including 2.15.0, remove the JndiLookup class from the classpath to mitigate the issue. Example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
org.apache.logging.log4j:log4j-core JndiLookup class = removed - Configuration
Keep org.apache.logging.log4j:log4j-api at the same version as org.apache.logging.log4j:log4j-core to ensure compatibility (set the API dependency version to the same fixed_version used for log4j-core).
org.apache.logging.log4j:log4j-api version = match log4j-core version
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the impact of CVE-2021-45046?
The impact of CVE-2021-45046 is critical, with a severity value of 9. It could allow attackers with control over Thread Context Map (MDC) input data to execute arbitrary code.
What is the affected software for CVE-2021-45046?
The affected software includes Apache Log4j2 versions prior to 2.17.1 and certain versions of eap7-log4j, log4j, and org.apache.logging.log4j:log4j-core.
How can I fix CVE-2021-45046?
To fix CVE-2021-45046, update Apache Log4j2 to version 2.17.1 or newer. If using eap7-log4j, log4j, or org.apache.logging.log4j:log4j-core, update to the recommended versions provided by the respective vendors.
Where can I find more information about CVE-2021-45046?
You can find more information about CVE-2021-45046 on the Apache Log4j website, CVE website, NIST National Vulnerability Database, Red Hat Security Advisories, and the Openwall mailing list.
What are the CWEs associated with CVE-2021-45046?
The CWEs associated with CVE-2021-45046 are CWE-20, CWE-502, CWE-400, and CWE-917.