Security Advisory - Apache log4j2 remote code execution vulnerabilities in some Huawei products

Some Huawei products are affected by the Apache Log4j2 remote code execution vulnerabilities. The vulnerabilities are caused by a recursive parsing error in some functions of Apache Log4j2. An attacker can construct a malicious request to control log parameters to trigger a remote code execution vulnerability. (Vulnerability ID: HWPSIRT-2021-28415 and HWPSIRT-2021-94301)

The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2021-45046 and CVE-2021-44228.

For products that have released software updates to fix these vulnerabilities, Huawei will release and update this Security Advisory at:

[

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211215-01-log4j-en

](<http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211215-01-log4j-en&gt;)