CVE-2021-45105 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

🗓️ 18 Dec 2021 11:55:08Reported by apacheType

CVE-2021-45105 Apache Log4j2 recursion vulnerability fix implemente

Reporter	Title	Published	Views	Family All 434
IBM Security Bulletins	Security Bulletin: Due to use of Apache Log4j, IBM Content Navigator is vulnerable to arbitrary code execution (CVE-2021-45046) and denial of service (CVE-2021-45105)	25 Feb 202223:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44832, CVE-2021-45046, ) and denial of service due to Apache Log4j (CVE-2021-45105)	28 Jan 202216:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i2 Analyze and IBM i2 Analyst's Notebook Premium are affected by Apache Log4j Vulnerabilities (CVE-2021-45105 and CVE-2021-45046)	31 Dec 202120:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)	14 Jan 202221:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Log4j affects Content Collector for IBM Connections (CVE-2021-45105)	14 Jan 202213:16	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Log4j vulnerability impacts IBM Sterling Partner Engagement Manager (CVE-2021-45105, CVE-2021-45046)	5 Jan 202208:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® PureData System for Operational Analytics is vulnerable to arbitrary code execution, remote code execution and denial of service due to Apache Log4j (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)	31 May 202216:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerablity in Apache Log4j may affect IBM Tivoli Monitoring (CVE-2021-4104)	30 Dec 202217:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44832, CVE-2021-45046, ) and denial of service due to Apache Log4j (CVE-2021-45105)	13 Jan 202220:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerabilities(CVE-2021-45105, CVE-2021-45046)	10 Jun 202216:52	–	ibm

[
  {
    "product": "Apache Log4j2",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "2.13.0",
            "status": "affected"
          },
          {
            "at": "2.12.3",
            "status": "unaffected"
          },
          {
            "at": "2.4",
            "status": "affected"
          },
          {
            "at": "2.3.1",
            "status": "unaffected"
          },
          {
            "at": "2.0-alpha1",
            "status": "affected"
          }
        ],
        "lessThan": "2.17.0",
        "status": "affected",
        "version": "log4j-core",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
kb	www.kb.cert.org/vuls/id/930724
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
security	www.security.netapp.com/advisory/ntap-20211218-0001/
oracle	www.oracle.com/security-alerts/cpujan2022.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
openwall	www.openwall.com/lists/oss-security/2021/12/19/1
oracle	www.oracle.com/security-alerts/cpuapr2022.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
debian	www.debian.org/security/2021/dsa-5024

25 Jul 2022 16:41Current

7.2High risk

Vulners AI Score7.2

EPSS0.99999