CVE-2021-45105: Apache log4j2 log messages substitution (CVE-2021-44228)
A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.
Other sources
Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled (CVE-2021-44228).
— FortiGuard
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.
Affected packages Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.
— GitHub
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.
This issue is being tracked as LOG4J2-3230
Mitigation:
Implement one of the following mitigation techniques:
Java 8 (or later) users should upgrade to release 2.17.0.
Alternatively, this can be mitigated in configuration:
In PatternLayout in the logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC). Otherwise, in the configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.
Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.
Reference: https://logging.apache.org/log4j/2.x/security.html https://www.openwall.com/lists/oss-security/2021/12/19/1 https://issues.apache.org/jira/browse/LOG4J2-3230
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/eap7-log4jto a version that resolves this vulnerability.Fixed in 0:2.17.1-1.redhat_00001.1.el8ea - Upgrade
Upgrade
redhat/eap7-log4jto a version that resolves this vulnerability.Fixed in 0:2.17.1-1.redhat_00001.1.el7ea - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:15.0.6-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:15.0.6-1.redhat_00001.1.el8 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.1-1~deb10u1Fixed in 2.17.0-1~deb10u1Fixed in 2.17.1-1~deb11u1Fixed in 2.17.0-1~deb11u1Fixed in 2.19.0-2 - Upgrade
Upgrade
debian/apache-log4j2to a version that resolves this vulnerability.Fixed in 2.17.0-1Fixed in 2.17.0-1~deb11u1Fixed in 2.17.0-1~deb10u1 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 2.0.13 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.11.12 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.10.9 - Upgrade
Upgrade
maven/org.ops4j.pax.logging:pax-logging-log4j2to a version that resolves this vulnerability.Fixed in 1.9.2 - Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.17.0 - Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.12.3 - Upgrade
Upgrade
redhat/log4jto a version that resolves this vulnerability.Fixed in 2.17.0 - Upgrade
Upgrade
redhat/log4jto a version that resolves this vulnerability.Fixed in 2.12.3 - Upgrade
Upgrade
redhat/log4jto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.17.0 - Upgrade
Upgrade
org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.12.3 - Upgrade
Upgrade
org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.3.1 - Configuration
In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}.
Log4j PatternLayout (log4j-core logging configuration) Context Lookups in PatternLayout (e.g., ${ctx:loginId} or $${ctx:loginId}) = Replace with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId} - Configuration
Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.
Log4j PatternLayout (log4j-core logging configuration) Context Lookups in PatternLayout (e.g., ${ctx:loginId} or $${ctx:loginId}) = Remove references
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-45105?
CVE-2021-45105 is rated as critical due to the potential for remote code execution through malicious crafted input.
How do I fix CVE-2021-45105?
To fix CVE-2021-45105, update the Apache Log4j library to versions 2.17.1 or later.
What applications are affected by CVE-2021-45105?
CVE-2021-45105 affects various applications utilizing vulnerable versions of the Apache Log4j 2.x logging library.
Can CVE-2021-45105 lead to data compromise?
Yes, the exploitation of CVE-2021-45105 can allow attackers to execute arbitrary code, potentially leading to data compromise.
Is there a workaround for CVE-2021-45105?
If immediate updating is not possible, consider disabling the logging configuration using a non-default Pattern Layout with context lookups.