CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
- Score
- CVSS 3.1 5.9 Medium
- Status
- Modified - security@apache.org
- Published
- 2021-12-18
- Last modified
- 2026-05-29
- Weaknesses
- CWE-20, CWE-674
Affected products
- Log4j (Apache)
- Apache Log4j2 (Apache Software Foundation)
- Debian Linux (Debian)
- Cloud Manager (Netapp)
- Agile Engineering Data Management (Oracle)
- Agile Plm Mcad Connector (Oracle)
- Agile Product Lifecycle Management (Oracle)
- Autovue For Agile Product Lifecycle Management (Oracle)
- Banking Deposits And Lines Of Credit Servicing (Oracle)
- Banking Enterprise Default Management (Oracle)
- Banking Loans Servicing (Oracle)
- Banking Party Management (Oracle)
- Banking Payments (Oracle)
- Banking Platform (Oracle)
- Banking Trade Finance (Oracle)
- Banking Treasury Management (Oracle)
- Business Intelligence (Oracle)
- Communications Asap (Oracle)
- Communications Billing And Revenue Management (Oracle)
- Communications Cloud Native Core Console (Oracle)
- Communications Cloud Native Core Network Function Cloud Native Environment (Oracle)
- Communications Cloud Native Core Network Repository Function (Oracle)
- Communications Cloud Native Core Network Slice Selection Function (Oracle)
- Communications Cloud Native Core Policy (Oracle)
- Communications Cloud Native Core Security Edge Protection Proxy (Oracle)
- Communications Cloud Native Core Service Communication Proxy (Oracle)
- Communications Cloud Native Core Unified Data Repository (Oracle)
- Communications Convergence (Oracle)
- Communications Convergent Charging Controller (Oracle)
- Communications Diameter Signaling Router (Oracle)
- Communications Eagle Element Management System (Oracle)
- Communications Eagle Ftp Table Base Retrieval (Oracle)
- Communications Element Manager (Oracle)
- Communications Evolved Communications Application Server (Oracle)
- Communications Interactive Session Recorder (Oracle)
- Communications Ip Service Activator (Oracle)
- Communications Messaging Server (Oracle)
- Communications Network Charging And Control (Oracle)
- Communications Network Integrity (Oracle)
- Communications Performance Intelligence Center (Oracle)
- Communications Pricing Design Center (Oracle)
- Communications Service Broker (Oracle)
- Communications Services Gatekeeper (Oracle)
- Communications Session Report Manager (Oracle)
- Communications Session Route Manager (Oracle)
- Communications Unified Inventory Management (Oracle)
- Communications User Data Repository (Oracle)
- Communications Webrtc Session Controller (Oracle)
- Data Integrator (Oracle)
- E-business Suite (Oracle)
- Enterprise Manager Base Platform (Oracle)
- Enterprise Manager For Peoplesoft (Oracle)
- Enterprise Manager Ops Center (Oracle)
- Financial Services Analytical Applications Infrastructure (Oracle)
- Financial Services Model Management And Governance (Oracle)
- Flexcube Universal Banking (Oracle)
- Health Sciences Empirica Signal (Oracle)
- Health Sciences Inform (Oracle)
- Health Sciences Information Manager (Oracle)
- Healthcare Data Repository (Oracle)
- Healthcare Foundation (Oracle)
- Healthcare Master Person Index (Oracle)
- Healthcare Translational Research (Oracle)
- Hospitality Suite8 (Oracle)
- Hospitality Token Proxy Service (Oracle)
- Hyperion Bi+ (Oracle)
- Hyperion Data Relationship Management (Oracle)
- Hyperion Infrastructure Technology (Oracle)
- Hyperion Planning (Oracle)
- Hyperion Profitability And Cost Management (Oracle)
- Hyperion Tax Provision (Oracle)
- Identity Management Suite (Oracle)
- Identity Manager Connector (Oracle)
- Instantis Enterprisetrack (Oracle)
- Insurance Data Gateway (Oracle)
- Insurance Insbridge Rating And Underwriting (Oracle)
- Jdeveloper (Oracle)
- Managed File Transfer (Oracle)
- Management Cloud Engine (Oracle)
- Mysql Enterprise Monitor (Oracle)
- Payment Interface (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
- Primavera Gateway (Oracle)
- Primavera P6 Enterprise Project Portfolio Management (Oracle)
- Primavera Unifier (Oracle)
- Retail Back Office (Oracle)
- Retail Central Office (Oracle)
- Retail Customer Insights (Oracle)
- Retail Data Extractor For Merchandising (Oracle)
- Retail Eftlink (Oracle)
- Retail Financial Integration (Oracle)
- Retail Integration Bus (Oracle)
- Retail Invoice Matching (Oracle)
- Retail Merchandising System (Oracle)
- Retail Order Broker (Oracle)
- Retail Order Management System (Oracle)
- Retail Point-of-service (Oracle)
- Retail Predictive Application Server (Oracle)
- Retail Price Management (Oracle)
- Retail Returns Management (Oracle)
References
- http://www.openwall.com/lists/oss-security/2021/12/19/1
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
- https://logging.apache.org/log4j/2.x/security.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://security.netapp.com/advisory/ntap-20211218-0001/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://www.debian.org/security/2021/dsa-5024
- https://www.kb.cert.org/vuls/id/930724
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
