IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.0Kritik KEV Fidye yazılımında kullanılıyor

CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Apache Software Foundation Apache Log4j Yayım: (4 yıl önce)

Aktif olarak istismar ediliyor — Apache Log4j2 Deserialization of Untrusted Data Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 01.05.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 22.05.2023.

Gerekli işlem: Apply updates per vendor instructions. https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046

Açıklama

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Zayıflık türü (CWE): CWE-917

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Apache Software Foundation Apache Log4j Apache Log4j2 – < 2.16.0
apache log4j 2.0.1 – < 2.12.2
cvat computer vision annotation tool —
debian debian linux 10.0
fedoraproject fedora 34
intel audio development kit —
intel datacenter manager —
intel genomics kernel library —
intel oneapi —
intel secure device onboard —
intel sensor solution firmware development kit —
intel system debugger —
intel system studio —
siemens 6bk1602-0aa12-0tp0 firmware < 2.7.0
siemens 6bk1602-0aa22-0tp0 firmware < 2.7.0
siemens 6bk1602-0aa32-0tp0 firmware < 2.7.0
siemens 6bk1602-0aa42-0tp0 firmware < 2.7.0
siemens 6bk1602-0aa52-0tp0 firmware < 2.7.0
siemens captial < 2019.1
siemens comos —
siemens desigo cc advanced reports 4.0
siemens desigo cc info center 5.0
siemens e-car operation center < 2021-12-13
siemens energy engage 3.1
siemens energyip 8.5
siemens energyip prepay 3.7
siemens gma-manager < 8.6.2j-398
siemens head-end system universal device integration system —
siemens industrial edge management —
siemens industrial edge management hub < 2021-12-13
siemens logo! soft comfort —
siemens mendix —
siemens mindsphere < 2021-12-11
siemens navigator < 2021-12-13
siemens nx —
siemens opcenter intelligence ≤ 3.2
siemens operation scheduler ≤ 1.1.3
siemens sentron powermanager 4.1
siemens siguard dsa 4.2
siemens sipass integrated 2.80
siemens siveillance command ≤ 4.16.2.1
siemens siveillance control pro —
siemens siveillance identity 1.5
siemens siveillance vantage —
siemens siveillance viewpoint —
siemens solid edge cam pro —
siemens solid edge harness design < 2020
siemens spectrum power 4 < 4.70
siemens spectrum power 7 < 2.30
siemens sppa-t3000 ses3000 firmware —
siemens teamcenter —
siemens tracealertserverplus —
siemens vesys < 2019.1
siemens xpedition enterprise —
siemens xpedition package integrator —
sonicwall email security < 10.0.12

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (60)
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* ≥ 2.0.1 < 2.12.2
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* ≥ 2.13.0 < 2.16.0
  • cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*
  • cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*
  • cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:*
  • cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*
  • cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*
  • cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:* < 2019.1
  • cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*
  • cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*
  • cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* < 2021-12-13
  • cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* < 8.6.2j-398
  • cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* < 2021-12-13
  • cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* < 2021-12-11
  • cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* < 2021-12-13
  • cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* ≤ 3.2
  • cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* ≤ 1.1.3
  • cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* ≤ 4.16.2.1
  • cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*

Aynı üründe son açıklar — Debian

9.2Kritik
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Calibre; Siemens Calibre ICE; Siemens Capital

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
8.4Yüksek
CVE-2026-77118

Out-of-bounds write in GraphicsMagick PCD decoder

GraphicsMagick Group GraphicsMagick; Debian graphicsmagick; Fedora Project GraphicsMagick

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…

6.0Orta
CVE-2026-12996
OpenVPN OpenVPN

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

3.7Düşük
CVE-2026-56968
GNU GNU SASL

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

7.5Yüksek
CVE-2026-49975

Apache HTTP Server: mod_http2 denial of service

Apache Software Foundation Apache HTTP Server; Red Hat JBoss Core Services for RHEL 8; Red Hat JBoss Core Services on RHEL 7; Red Hat Red Hat Enterprise Linux 10

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

33%EPSS