apache log4j CVE-2021-45105 vulnerability in Apache and Other Products
Published on December 18, 2021

product logo product logo product logo product logo product logo product logo
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Github Repository Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2021-45105 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2021-45105 has been classified to as a Stack Exhaustion vulnerability or weakness.


Products Associated with CVE-2021-45105

You can be notified by stack.watch whenever vulnerabilities like CVE-2021-45105 are published in these products:

Apache Log4j
 
NetApp Cloud Manager
 
Debian Linux
 
SonicWall Email Security
 
SonicWall Network Security Manager
 
SonicWall Web Application Firewall
 
Canonical Ubuntu Linux
 
Oracle Business Intelligence
 
Oracle Communications Diameter Signaling Router
 
Oracle Communications Interactive Session Recorder
 
Oracle Communications Service Broker
 
Oracle Communications Services Gatekeeper
 
Oracle Communications Webrtc Session Controller
 
Oracle Financial Services Analytical Applications Infrastructure
 
Oracle Financial Services Model Management Governance
 
Oracle Instantis Enterprisetrack
 
Oracle Managed File Transfer
 
Oracle Primavera Gateway
 
Oracle Primavera P6 Enterprise Project Portfolio Management
 
Oracle Primavera Unifier
 
Oracle Retail Back Office
 
Oracle Retail Central Office
 
Oracle Retail Eftlink
 
Oracle Retail Integration Bus
 
Oracle Retail Invoice Matching
 
Oracle Retail Order Broker
 
Oracle Retail Order Management System
 
Oracle Retail Point Of Service
 
Oracle Retail Predictive Application Server
 
Oracle Retail Price Management
 
Oracle Retail Returns Management
 
Oracle Retail Service Backbone
 
Oracle Siebel Ui Framework
 
Oracle Webcenter Portal
 
Oracle Weblogic Server
 
Oracle E Business Suite
 
Oracle Webcenter Sites
 
Oracle Communications Unified Inventory Management
 
Oracle Identity Management Suite
 
Oracle Data Integrator
 
Oracle Flexcube Universal Banking
 
Oracle Banking Platform
 
Oracle Peoplesoft Enterprise Peopletools
 
Oracle Utilities Framework
 
Oracle Agile Plm
 
Oracle Communications Ip Service Activator
 
Oracle Communications Performance Intelligence Center
 
Oracle Communications Evolved Communications Application Server
 
Oracle Communications Network Integrity
 
Oracle Jdeveloper
 
Oracle Enterprise Manager Ops Center
 
Oracle Enterprise Manager Peoplesoft
 
Oracle Enterprise Manager Base Platform
 
Oracle Insurance Insbridge Rating Underwriting
 
Oracle Agile Engineering Data Management
 
Oracle Retail Merchandising System
 
Oracle Communications Messaging Server
 
Oracle Communications Convergent Charging Controller
 
Oracle Communications Convergence
 
Oracle Communications Billing Revenue Management
 
Oracle Communications Asap
 
Oracle Communications Session Route Manager
 
Oracle Communications Session Report Manager
 
Oracle Communications Element Manager
 
Oracle Communications Eagle Ftp Table Base Retrieval
 
Oracle Communications Cloud Native Core Security Edge Protection Proxy
 
Oracle Communications Pricing Design Center
 
Oracle Communications Network Charging Control
 
Oracle Banking Party Management
 
Oracle Banking Loans Servicing
 
Oracle Banking Enterprise Default Management
 
Oracle Banking Deposits Lines Credit Servicing
 
Oracle Hospitality Suite8
 
Oracle Healthcare Translational Research
 
Oracle Healthcare Data Repository
 
Oracle Retail Financial Integration
 
Oracle Autovue Agile Product Lifecycle Management
 
Oracle Agile Plm Mcad Connector
 
Oracle Sql Developer
 
Oracle Communications User Data Repository
 
Oracle Communications Eagle Element Management System
 
Oracle Communications Cloud Native Core Unified Data Repository
 
Oracle Communications Cloud Native Core Service Communication Proxy
 
Oracle Communications Cloud Native Core Policy
 
Oracle Communications Cloud Native Core Network Slice Selection Function
 
Oracle Communications Cloud Native Core Network Repository Function
 
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
 
Oracle Communications Cloud Native Core Console
 
Oracle Management Cloud Engine
 
Oracle Identity Manager Connector
 
Oracle Banking Treasury Management
 
Oracle Banking Trade Finance
 
Oracle Banking Payments
 
Oracle Payment Interface
 
Oracle Hospitality Token Proxy Service
 
Oracle Healthcare Master Person Index
 
Oracle Healthcare Foundation
 
Oracle Health Sciences Information Manager
 
Oracle Health Sciences Inform
 
Oracle Health Sciences Empirica Signal
 
Oracle Mysql Enterprise Monitor
 
Oracle Insurance Data Gateway
 
Oracle Hyperion Tax Provision
 
Oracle Hyperion Profitability Cost Management
 
Oracle Hyperion Planning
 
Oracle Hyperion Infrastructure Technology
 
Oracle Hyperion Data Relationship Management
 
Oracle Hyperion Bi
 
Oracle Retail Store Inventory Management
 
Oracle Retail Data Extractor Merchandising
 
Oracle Retail Customer Insights
 
Oracle Taleo Platform
 

What versions are vulnerable to CVE-2021-45105?

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-45105

Package Manager Vulnerable Package Versions Fixed In
maven org.powernukkit:powernukkit <= 1.5.2.0 1.5.2.1
maven com.hazelcast.jet:hazelcast-jet >= 4.1, < 4.5.3 4.5.3
maven com.hazelcast:hazelcast >= 5.0, < 5.0.2 5.0.2
maven com.hazelcast:hazelcast < 4.0.5 4.0.5
maven com.hazelcast:hazelcast >= 4.1.1, < 4.1.8 4.1.8
maven com.hazelcast:hazelcast >= 4.2, < 4.2.4 4.2.4