CVE-2021-45046
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Apache Log4j2
PublishedDec 14, 2021
First seenDec 14, 2021
Added to KEVMay 1, 2023
Weakness typeCWE-917Expression language injection
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 22, 2023Update
- apache log4j2.12.2, 2.16.0 or later
- siemens captial2019.1 or later
- siemens e-car_operation_center2021-12-13 or later
- siemens gma-manager8.6.2j-398 or later
- siemens industrial_edge_management_hub2021-12-13 or later
- siemens mindsphere2021-12-11 or later
- siemens navigator2021-12-13 or later
- siemens solid_edge_harness_design2020 or later
- siemens spectrum_power_44.70 or later
- siemens spectrum_power_72.30 or later
- siemens vesys2019.1 or later
- sonicwall email_security10.0.12 or later
Vendor advisories
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- debian.org/security/2021/dsa-5022
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache log4j | 2.0.1 ≤ v < 2.12.2, 2.13.0 ≤ v < 2.16.0, 2.0 | 2.12.2, 2.16.0 |
| cvat computer_vision_annotation_tool | No range specified | — |
| intel audio_development_kit | No range specified | — |
| intel datacenter_manager | No range specified | — |
| intel genomics_kernel_library | No range specified | — |
| intel oneapi | No range specified | — |
| intel secure_device_onboard | No range specified | — |
| intel sensor_solution_firmware_development_kit | No range specified | — |
| intel system_debugger | No range specified | — |
| intel system_studio | No range specified | — |
| siemens sppa-t3000_ses3000_firmware | No range specified | — |
| siemens captial | v < 2019.1, 2019.1 | 2019.1 |
| siemens comos | No range specified | — |
| siemens desigo_cc_advanced_reports | 4.0, 4.1, 4.2, 5.0, 5.1 | — |
| siemens desigo_cc_info_center | 5.0, 5.1 | — |
| siemens e-car_operation_center | v < 2021-12-13 | 2021-12-13 |
| siemens energy_engage | 3.1 | — |
| siemens energyip | 8.5, 8.6, 8.7, 9.0 | — |
| siemens energyip_prepay | 3.7, 3.8 | — |
| siemens gma-manager | v < 8.6.2j-398 | 8.6.2j-398 |
| siemens head-end_system_universal_device_integration_system | No range specified | — |
| siemens industrial_edge_management | No range specified | — |
| siemens industrial_edge_management_hub | v < 2021-12-13 | 2021-12-13 |
| siemens logo\!_soft_comfort | No range specified | — |
| siemens mendix | No range specified | — |
| siemens mindsphere | v < 2021-12-11 | 2021-12-11 |
| siemens navigator | v < 2021-12-13 | 2021-12-13 |
| siemens nx | No range specified | — |
| siemens opcenter_intelligence | v ≤ 3.2 | — |
| siemens operation_scheduler | v ≤ 1.1.3 | — |
| siemens sentron_powermanager | 4.1, 4.2 | — |
| siemens siguard_dsa | 4.2, 4.3, 4.4 | — |
| siemens sipass_integrated | 2.80, 2.85 | — |
| siemens siveillance_command | v ≤ 4.16.2.1 | — |
| siemens siveillance_control_pro | No range specified | — |
| siemens siveillance_identity | 1.5, 1.6 | — |
| siemens siveillance_vantage | No range specified | — |
| siemens siveillance_viewpoint | No range specified | — |
| siemens solid_edge_cam_pro | No range specified | — |
| siemens solid_edge_harness_design | v < 2020, 2020 | 2020 |
| siemens spectrum_power_4 | v < 4.70, 4.70 | 4.70 |
| siemens spectrum_power_7 | v < 2.30, 2.30 | 2.30 |
| siemens teamcenter | No range specified | — |
| siemens tracealertserverplus | No range specified | — |
| siemens vesys | v < 2019.1, 2019.1 | 2019.1 |
| siemens xpedition_enterprise | No range specified | — |
| siemens xpedition_package_integrator | No range specified | — |
| debian debian_linux | 10.0, 11.0 | — |
| sonicwall email_security | v < 10.0.12 | 10.0.12 |
| fedoraproject fedora | 34, 35 | — |
| siemens 6bk1602-0aa12-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa22-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa32-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa42-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa52-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| org.apache.logging.log4j:log4j-coreMaven | 2.13.0 ≤ v < 2.16.0, 2.4.0 ≤ v < 2.12.2, v < 2.3.1 | 2.16.0, 2.12.2, 2.3.1 |
| org.ops4j.pax.logging:pax-logging-log4j2Maven | 1.8.0 ≤ v < 1.9.2, 1.10.0 ≤ v < 1.10.8, 1.11.0 ≤ v < 1.11.11, 2.0.0 ≤ v < 2.0.12 | 1.9.2, 1.10.8, 1.11.11, 2.0.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.