ZDI-21-1541: Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Apache Log4j. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StrSubstitutor class. The issue results from the lack of proper validation of user-supplied data, which can result in a resource exhaustion condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the process.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Log4j |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-21-1541?
The severity of ZDI-21-1541 is critical due to its potential to cause a remote denial-of-service condition.
How do I fix ZDI-21-1541?
To fix ZDI-21-1541, you should upgrade to the latest version of Apache Log4j where the vulnerability is addressed.
Who is affected by ZDI-21-1541?
Any installations of Apache Log4j that utilize the StrSubstitutor class are affected by ZDI-21-1541.
Can ZDI-21-1541 be exploited without authentication?
Yes, ZDI-21-1541 can be exploited without any authentication, allowing remote attackers to target affected systems.
What is the consequence of ZDI-21-1541?
The consequence of ZDI-21-1541 is a denial-of-service condition that can disrupt operations of the affected server.
- agent/references
- agent/type
- agent/softwarecombine
- agent/severity
- agent/title
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-1541
- alias/ZDI-CAN-16160
- alias/CVE-2021-45105
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache log4j