Lucene search

[email protected]NVD:CVE-2021-45046

HistoryDec 14, 2021 - 7:15 p.m.

CVE-2021-45046

2021-12-1419:15:07

CWE-917

[email protected]

web.nvd.nist.gov

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

JSON

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Affected configurations

NVD

Node

apachelog4jRange2.0.1–2.12.2

apachelog4jRange2.13.0–2.16.0

apachelog4jMatch2.0-

apachelog4jMatch2.0beta9

apachelog4jMatch2.0rc1

apachelog4jMatch2.0rc2

Node

intelaudio_development_kitMatch-

intelcomputer_vision_annotation_toolMatch-

inteldatacenter_managerMatch-

intelgenomics_kernel_libraryMatch-

inteloneapiMatch-eclipse

intelsecure_device_onboardMatch-

intelsensor_solution_firmware_development_kitMatch-

intelsystem_debuggerMatch-

intelsystem_studioMatch-

Node

siemenssppa-t3000_ses3000Match-

AND

siemenssppa-t3000_ses3000_firmware

Node

siemenscaptialRange<2019.1

siemenscaptialMatch2019.1-

siemenscaptialMatch2019.1sp1912

siemenscomos

siemensdesigo_cc_advanced_reportsMatch4.0

siemensdesigo_cc_advanced_reportsMatch4.1

siemensdesigo_cc_advanced_reportsMatch4.2

siemensdesigo_cc_advanced_reportsMatch5.0

siemensdesigo_cc_advanced_reportsMatch5.1

siemensdesigo_cc_info_centerMatch5.0

siemensdesigo_cc_info_centerMatch5.1

siemense-car_operation_centerRange<2021-12-13

siemensenergy_engageMatch3.1

siemensenergyipMatch8.5

siemensenergyipMatch8.6

siemensenergyipMatch8.7

siemensenergyipMatch9.0

siemensenergyip_prepayMatch3.7

siemensenergyip_prepayMatch3.8

siemensgma-managerRange<8.6.2j-398

siemenshead-end_system_universal_device_integration_system

siemensindustrial_edge_management

siemensindustrial_edge_management_hubRange<2021-12-13

siemenslogo\!_soft_comfort

siemensmendix

siemensmindsphereRange<2021-12-11

siemensnavigatorRange<2021-12-13

siemensnx

siemensopcenter_intelligenceRange≤3.2

siemensoperation_schedulerRange≤1.1.3

siemenssentron_powermanagerMatch4.1

siemenssentron_powermanagerMatch4.2

siemenssiguard_dsaMatch4.2

siemenssiguard_dsaMatch4.3

siemenssiguard_dsaMatch4.4

siemenssipass_integratedMatch2.80

siemenssipass_integratedMatch2.85

siemenssiveillance_commandRange≤4.16.2.1

siemenssiveillance_control_pro

siemenssiveillance_identityMatch1.5

siemenssiveillance_identityMatch1.6

siemenssiveillance_vantage

siemenssiveillance_viewpoint

siemenssolid_edge_cam_pro

siemenssolid_edge_harness_designRange<2020

siemenssolid_edge_harness_designMatch2020

siemenssolid_edge_harness_designMatch2020-

siemenssolid_edge_harness_designMatch2020sp2002

siemensspectrum_power_4Range<4.70

siemensspectrum_power_4Match4.70-

siemensspectrum_power_4Match4.70sp7

siemensspectrum_power_4Match4.70sp8

siemensspectrum_power_7Range<2.30

siemensspectrum_power_7Match2.30

siemensspectrum_power_7Match2.30-

siemensspectrum_power_7Match2.30sp2

siemensteamcenter

siemenstracealertserverplus

siemensvesysRange<2019.1

siemensvesysMatch2019.1

siemensvesysMatch2019.1-

siemensvesysMatch2019.1sp1912

siemensxpedition_enterpriseMatch-

siemensxpedition_package_integratorMatch-

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

sonicwallemail_securityRange<10.0.12

Node

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

Node

siemens6bk1602-0aa12-0tp0Match-

AND

siemens6bk1602-0aa12-0tp0_firmwareRange<2.7.0

Node

siemens6bk1602-0aa22-0tp0Match-

AND

siemens6bk1602-0aa22-0tp0_firmwareRange<2.7.0

Node

siemens6bk1602-0aa32-0tp0Match-

AND

siemens6bk1602-0aa32-0tp0_firmwareRange<2.7.0

Node

siemens6bk1602-0aa42-0tp0Match-

AND

siemens6bk1602-0aa42-0tp0_firmwareRange<2.7.0

Node

siemens6bk1602-0aa52-0tp0Match-

AND

siemens6bk1602-0aa52-0tp0_firmwareRange<2.7.0

References

www.openwall.com/lists/oss-security/2021/12/14/4

www.openwall.com/lists/oss-security/2021/12/15/3

www.openwall.com/lists/oss-security/2021/12/18/1

cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf

cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

logging.apache.org/log4j/2.x/security.html

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

security.gentoo.org/glsa/202310-16

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

www.cve.org/CVERecord?id=CVE-2021-44228

www.debian.org/security/2021/dsa-5022

www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html

www.kb.cert.org/vuls/id/930724

www.oracle.com/security-alerts/alert-cve-2021-44228.html

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2022.html

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

JSON

CVE-2021-45046

Affected configurations

References

Related