CVE-2021-45105
Orta
Açıklama
Apache Log4j2'nin 2.0-alpha1 ile 2.16.0 arasındaki sürümleri (2.12.3 ve 2.3.1 hariç), kendi kendine referans veren aramaların neden olduğu kontrolsüz özyinelemeden korunmamaktaydı. Bu durum, Thread Context Map verileri üzerinde kontrol sahibi olan bir saldırganın, özel olarak hazırlanmış bir dize yorumlandığında hizmet reddine yol açmasına olanak tanır. Bu sorun Log4j 2.17.0, 2.12.3 ve 2.3.1 sürümlerinde giderilmiştir.
ÖnemOrta
CVSS5.9
İstismar olasılığı—
Ürün
Apache Log4j
Yayın18 Ara 2021
İlk görülme18 Ara 2021
Zayıflık türüCWE-20Girdinin yetersiz doğrulanmasıCWE-674CWE-674
Nasıl düzeltilir
Güncelleyin
- apache log4j2.3.1, 2.12.3 ya da sonraki bir sürüm
- sonicwall network_security_manager3.0 ya da sonraki bir sürüm
- sonicwall web_application_firewall3.1.0 ya da sonraki bir sürüm
- sonicwall 6bk1602-0aa12-0tp0_firmware2.7.0 ya da sonraki bir sürüm
- sonicwall 6bk1602-0aa22-0tp0_firmware2.7.0 ya da sonraki bir sürüm
- sonicwall 6bk1602-0aa32-0tp0_firmware2.7.0 ya da sonraki bir sürüm
- sonicwall 6bk1602-0aa42-0tp0_firmware2.7.0 ya da sonraki bir sürüm
- sonicwall 6bk1602-0aa52-0tp0_firmware2.7.0 ya da sonraki bir sürüm
- oracle communications_element_manager9.0 ya da sonraki bir sürüm
- oracle communications_session_report_manager9.0 ya da sonraki bir sürüm
- oracle communications_session_route_manager9.0 ya da sonraki bir sürüm
- oracle hyperion_bi\+11.2.8.0 ya da sonraki bir sürüm
Etkilenen ürünler
| Ürün | Etkilenen sürümler | Düzeltildiği sürüm |
|---|---|---|
| apache log4j | 2.0 ≤ v < 2.3.1, 2.4 ≤ v < 2.12.3, 2.13.0 ≤ v ≤ 2.16.0 | 2.3.1, 2.12.3 |
| netapp cloud_manager | Aralık belirtilmemiş | — |
| debian debian_linux | 10.0, 11.0 | — |
| sonicwall email_security | v ≤ 10.0.12 | — |
| sonicwall network_security_manager | 2.0 ≤ v < 3.0 | 3.0 |
| sonicwall web_application_firewall | 3.0.0 ≤ v < 3.1.0 | 3.1.0 |
| sonicwall 6bk1602-0aa12-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| sonicwall 6bk1602-0aa22-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| sonicwall 6bk1602-0aa32-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| sonicwall 6bk1602-0aa42-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| sonicwall 6bk1602-0aa52-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_plm_mcad_connector | 3.6 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle autovue_for_agile_product_lifecycle_management | 21.0.2 | — |
| oracle banking_deposits_and_lines_of_credit_servicing | 2.12.0 | — |
| oracle banking_enterprise_default_management | 2.7.1, 2.12.0 | — |
| oracle banking_loans_servicing | 2.12.0 | — |
| oracle banking_party_management | 2.7.0 | — |
| oracle banking_payments | 14.5 | — |
| oracle banking_platform | 2.6.2, 2.7.1, 2.12.0 | — |
| oracle banking_trade_finance | 14.5 | — |
| oracle banking_treasury_management | 14.5 | — |
| oracle business_intelligence | 5.5.0.0.0 | — |
| oracle communications_asap | 7.3 | — |
| oracle communications_billing_and_revenue_management | 12.0.0.4, 12.0.0.5 | — |
| oracle communications_cloud_native_core_console | 1.9.0 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.15.0, 1.15.1 | — |
| oracle communications_cloud_native_core_network_slice_selection_function | 1.8.0 | — |
| oracle communications_cloud_native_core_policy | 1.15.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | — |
| oracle communications_cloud_native_core_service_communication_proxy | 1.15.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.15.0 | — |
| oracle communications_convergence | 3.0.2.2.0, 3.0.3.0 | — |
| oracle communications_convergent_charging_controller | 12.0.1.0.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_diameter_signaling_router | 8.3.0.0 ≤ v ≤ 8.5.1.0 | — |
| oracle communications_eagle_element_management_system | 46.6 | — |
| oracle communications_eagle_ftp_table_base_retrieval | 4.5 | — |
| oracle communications_element_manager | v < 9.0 | 9.0 |
| oracle communications_evolved_communications_application_server | 7.1 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle communications_ip_service_activator | 7.4.0 | — |
| oracle communications_messaging_server | 8.1 | — |
| oracle communications_network_charging_and_control | 12.0.1.0.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_network_integrity | 7.3.6 | — |
| oracle communications_performance_intelligence_center | 10.4.0.3 | — |
| oracle communications_pricing_design_center | 12.0.0.4, 12.0.0.5 | — |
| oracle communications_service_broker | 6.2 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_report_manager | v < 9.0 | 9.0 |
| oracle communications_session_route_manager | v < 9.0 | 9.0 |
| oracle communications_unified_inventory_management | 7.3.5, 7.4.1, 7.4.2 | — |
| oracle communications_user_data_repository | 12.4 | — |
| oracle communications_webrtc_session_controller | 7.2.0.0, 7.2.1 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle e-business_suite | 12.2 | — |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle enterprise_manager_for_peoplesoft | 13.4.1.1, 13.5.1.1 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.7 ≤ v ≤ 8.1.1 | — |
| oracle financial_services_model_management_and_governance | 8.0.8.0.0, 8.1.0.0.0, 8.1.1.0.0 | — |
| oracle flexcube_universal_banking | 12.1.0 ≤ v ≤ 12.4, 14.0.0 ≤ v ≤ 14.3.0, 11.83.3, 14.5 | — |
| oracle health_sciences_empirica_signal | 9.1.0.6, 9.2.0.0 | — |
| oracle health_sciences_inform | 6.2.1.1, 6.3.2.1, 7.0.0.0 | — |
| oracle health_sciences_information_manager | 3.0.1 ≤ v ≤ 3.0.4 | — |
| oracle healthcare_data_repository | 8.1.1 | — |
| oracle healthcare_foundation | 7.3.0.1 ≤ v ≤ 7.3.0.4 | — |
| oracle healthcare_master_person_index | 5.0.1 | — |
| oracle healthcare_translational_research | 4.1.0, 4.1.1 | — |
| oracle hospitality_suite8 | 8.13.0, 8.14.0 | — |
| oracle hospitality_token_proxy_service | 19.2 | — |
| oracle hyperion_bi\+ | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_data_relationship_management | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_infrastructure_technology | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_planning | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_profitability_and_cost_management | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_tax_provision | v < 11.2.8.0 | 11.2.8.0 |
| oracle identity_management_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle identity_manager_connector | 9.1.0 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle insurance_data_gateway | 1.0.1 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.4 ≤ v ≤ 5.6.0.0, 5.2.0, 5.6.1.0 | — |
| oracle jdeveloper | 12.2.1.4.0 | — |
| oracle managed_file_transfer | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle management_cloud_engine | 1.5.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.29 | — |
| oracle payment_interface | 19.1, 20.3 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58, 8.59 | — |
| oracle primavera_gateway | 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.13, 19.12.0 ≤ v ≤ 19.12.12, 20.12.0 ≤ v ≤ 20.12.7, 21.12.0 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 19.12.0.0 ≤ v ≤ 19.12.18.0, 20.12.0.0 ≤ v ≤ 20.12.12.0, 21.12.0.0 | — |
| oracle primavera_unifier | 18.8, 19.12, 20.12, 21.12 | — |
| oracle retail_back_office | 14.1 | — |
| oracle retail_central_office | 14.1 | — |
| oracle retail_customer_insights | 15.0.2, 16.0.2 | — |
| oracle retail_data_extractor_for_merchandising | 15.0.2, 16.0.2 | — |
| oracle retail_eftlink | 16.0.3, 17.0.2, 18.0.1, 19.0.1, 20.0.1, 21.0.0 | — |
| oracle retail_financial_integration | 16.0.1 ≤ v ≤ 16.0.3, 14.1.3.2, 15.0.3.1, 19.0.0, 19.0.1 | — |
| oracle retail_integration_bus | 16.0.1 ≤ v ≤ 16.0.3, 19.0.0 ≤ v ≤ 19.0.1.0, 14.1.3, 14.1.3.2, 15.0.3.1, 19.0.0, 19.0.1 | — |
| oracle retail_invoice_matching | 15.0.3, 16.0.3 | — |
| oracle retail_merchandising_system | 16.0.3, 19.0.1 | — |
| oracle retail_order_broker | 16.0, 18.0, 19.1 | — |
| oracle retail_order_management_system | 19.5 | — |
| oracle retail_point-of-service | 14.1 | — |
| oracle retail_predictive_application_server | 14.1.3.46, 15.0.3.115, 16.0.3.240 | — |
| oracle retail_price_management | 13.2, 14.0.4, 14.1.3.0, 15.0.3.0, 16.0.3.0 | — |
| oracle retail_returns_management | 14.1 | — |
| oracle retail_service_backbone | 16.0.1 ≤ v ≤ 16.0.3, 14.1.3, 14.1.3.2, 15.0.3.1, 19.0.0, 19.0.1, 19.0.1.0 | — |
| oracle retail_store_inventory_management | 14.0.4.13, 14.1.3.5, 14.1.3.14, 15.0.3.3, 15.0.3.8, 16.0.3.7 | — |
| oracle siebel_ui_framework | v ≤ 21.12 | — |
| oracle sql_developer | v < 21.4.2 | 21.4.2 |
| oracle taleo_platform | v < 22.1 | 22.1 |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 | — |
Sürümünüzü kontrol edin
Ürünü seçin ve kullandığınız sürümü yazın; sürümün etkilenen aralıkta olup olmadığını görün.
Intelligence 360 paketinde
Attack Surface Management
Alan adlarınıza bağlı varlıkları, bu varlıklarda çalışan teknolojileri ve bilinen zafiyetleri tek listede görün.