CVE-2021-45046 vulnerability in Apache and Other Products
Published on December 14, 2021
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Known Exploited Vulnerability
This Apache Log4j2 Deserialization of Untrusted Data Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
The following remediation steps are recommended / required by May 22, 2023: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2021-45046 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an EL Injection Vulnerability?
The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CVE-2021-45046 has been classified to as an EL Injection vulnerability or weakness.
Products Associated with CVE-2021-45046
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-45046 are published in these products:
Affected Versions
Apache Software Foundation Apache Log4j:- Version Apache Log4j2 and below 2.16.0 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2021-45046
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.apache.logging.log4j:log4j-core | <2.16.0 | 2.16.0 |
| maven | com.hazelcast.jet:hazelcast-jet | >= 4.1, < 4.5.3 | 4.5.3 |
| maven | com.hazelcast:hazelcast | >= 5.0, < 5.0.2 | 5.0.2 |
| maven | com.hazelcast:hazelcast | < 4.0.5 | 4.0.5 |
| maven | com.hazelcast:hazelcast | >= 4.1.1, < 4.1.8 | 4.1.8 |
| maven | com.hazelcast:hazelcast | >= 4.2, < 4.2.4 | 4.2.4 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.