Lucene search

[email protected]NVD:CVE-2021-45105

HistoryDec 18, 2021 - 12:15 p.m.

CVE-2021-45105

2021-12-1812:15:07

CWE-20

CWE-674

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.966 High

EPSS

Percentile

99.6%

JSON

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected configurations

NVD

Node

apachelog4jRange2.0–2.3.1

apachelog4jRange2.4–2.12.3

apachelog4jRange2.13.0–2.16.0

Node

netappcloud_managerMatch-

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

sonicwallemail_securityRange≤10.0.12

sonicwallnetwork_security_managerRange2.0–3.0on-premises

sonicwallnetwork_security_managerRange2.0–3.0saas

sonicwallweb_application_firewallRange3.0.0–3.1.0

Node

sonicwall6bk1602-0aa12-0tp0Match-

AND

sonicwall6bk1602-0aa12-0tp0_firmwareRange<2.7.0

Node

sonicwall6bk1602-0aa22-0tp0Match-

AND

sonicwall6bk1602-0aa22-0tp0_firmwareRange<2.7.0

Node

sonicwall6bk1602-0aa32-0tp0Match-

AND

sonicwall6bk1602-0aa32-0tp0_firmwareRange<2.7.0

Node

sonicwall6bk1602-0aa42-0tp0Match-

AND

sonicwall6bk1602-0aa42-0tp0_firmwareRange<2.7.0

Node

sonicwall6bk1602-0aa52-0tp0Match-

AND

sonicwall6bk1602-0aa52-0tp0_firmwareRange<2.7.0

Node

oracleagile_engineering_data_managementMatch6.2.1.0

oracleagile_plmMatch9.3.6

oracleagile_plm_mcad_connectorMatch3.6

oracleautovue_for_agile_product_lifecycle_managementMatch21.0.2

oraclebanking_deposits_and_lines_of_credit_servicingMatch2.12.0

oraclebanking_enterprise_default_managementMatch2.7.1

oraclebanking_enterprise_default_managementMatch2.12.0

oraclebanking_loans_servicingMatch2.12.0

oraclebanking_party_managementMatch2.7.0

oraclebanking_paymentsMatch14.5

oraclebanking_platformMatch2.6.2

oraclebanking_platformMatch2.7.1

oraclebanking_platformMatch2.12.0

oraclebanking_trade_financeMatch14.5

oraclebanking_treasury_managementMatch14.5

oraclebusiness_intelligenceMatch5.5.0.0.0enterprise

oraclecommunications_asapMatch7.3

oraclecommunications_billing_and_revenue_managementMatch12.0.0.4

oraclecommunications_billing_and_revenue_managementMatch12.0.0.5

oraclecommunications_cloud_native_core_consoleMatch1.9.0

oraclecommunications_cloud_native_core_network_function_cloud_native_environmentMatch1.10.0

oraclecommunications_cloud_native_core_network_repository_functionMatch1.15.0

oraclecommunications_cloud_native_core_network_repository_functionMatch1.15.1

oraclecommunications_cloud_native_core_network_slice_selection_functionMatch1.8.0

oraclecommunications_cloud_native_core_policyMatch1.15.0

oraclecommunications_cloud_native_core_security_edge_protection_proxyMatch1.7.0

oraclecommunications_cloud_native_core_service_communication_proxyMatch1.15.0

oraclecommunications_cloud_native_core_unified_data_repositoryMatch1.15.0

oraclecommunications_convergenceMatch3.0.2.2.0

oraclecommunications_convergenceMatch3.0.3.0

oraclecommunications_convergent_charging_controllerRange12.0.1.0.0–12.0.4.0.0

oraclecommunications_convergent_charging_controllerMatch6.0.1.0.0

oraclecommunications_diameter_signaling_routerRange8.3.0.0–8.5.1.0

oraclecommunications_eagle_element_management_systemMatch46.6

oraclecommunications_eagle_ftp_table_base_retrievalMatch4.5

oraclecommunications_element_managerRange<9.0

oraclecommunications_evolved_communications_application_serverMatch7.1

oraclecommunications_interactive_session_recorderMatch6.3

oraclecommunications_interactive_session_recorderMatch6.4

oraclecommunications_ip_service_activatorMatch7.4.0

oraclecommunications_messaging_serverMatch8.1

oraclecommunications_network_charging_and_controlRange12.0.1.0.0–12.0.4.0.0

oraclecommunications_network_charging_and_controlMatch6.0.1.0.0

oraclecommunications_network_integrityMatch7.3.6

oraclecommunications_performance_intelligence_centerMatch10.4.0.3

oraclecommunications_pricing_design_centerMatch12.0.0.4

oraclecommunications_pricing_design_centerMatch12.0.0.5

oraclecommunications_service_brokerMatch6.2

oraclecommunications_services_gatekeeperMatch7.0

oraclecommunications_session_report_managerRange<9.0

oraclecommunications_session_route_managerRange<9.0

oraclecommunications_unified_inventory_managementMatch7.3.5

oraclecommunications_unified_inventory_managementMatch7.4.1

oraclecommunications_unified_inventory_managementMatch7.4.2

oraclecommunications_user_data_repositoryMatch12.4

oraclecommunications_webrtc_session_controllerMatch7.2.0.0

oraclecommunications_webrtc_session_controllerMatch7.2.1

oracledata_integratorMatch12.2.1.3.0

oracledata_integratorMatch12.2.1.4.0

oraclee-business_suiteMatch12.2

oracleenterprise_manager_base_platformMatch13.4.0.0

oracleenterprise_manager_base_platformMatch13.5.0.0

oracleenterprise_manager_for_peoplesoftMatch13.4.1.1

oracleenterprise_manager_for_peoplesoftMatch13.5.1.1

oracleenterprise_manager_ops_centerMatch12.4.0.0

oraclefinancial_services_analytical_applications_infrastructureRange8.0.7–8.1.1

oraclefinancial_services_model_management_and_governanceMatch8.0.8.0.0

oraclefinancial_services_model_management_and_governanceMatch8.1.0.0.0

oraclefinancial_services_model_management_and_governanceMatch8.1.1.0.0

oracleflexcube_universal_bankingRange12.1.0–12.4

oracleflexcube_universal_bankingRange14.0.0–14.3.0

oracleflexcube_universal_bankingMatch11.83.3

oracleflexcube_universal_bankingMatch14.5

oraclehealth_sciences_empirica_signalMatch9.1.0.6

oraclehealth_sciences_empirica_signalMatch9.2.0.0

oraclehealth_sciences_informMatch6.2.1.1

oraclehealth_sciences_informMatch6.3.2.1

oraclehealth_sciences_informMatch7.0.0.0

oraclehealth_sciences_information_managerRange3.0.1–3.0.4

oraclehealthcare_data_repositoryMatch8.1.1

oraclehealthcare_foundationRange7.3.0.1–7.3.0.4

oraclehealthcare_master_person_indexMatch5.0.1

oraclehealthcare_translational_researchMatch4.1.0

oraclehealthcare_translational_researchMatch4.1.1

oraclehospitality_suite8Match8.13.0

oraclehospitality_suite8Match8.14.0

oraclehospitality_token_proxy_serviceMatch19.2

oraclehyperion_bi\+Range<11.2.8.0

oraclehyperion_data_relationship_managementRange<11.2.8.0

oraclehyperion_infrastructure_technologyRange<11.2.8.0

oraclehyperion_planningRange<11.2.8.0

oraclehyperion_profitability_and_cost_managementRange<11.2.8.0

oraclehyperion_tax_provisionRange<11.2.8.0

oracleidentity_management_suiteMatch12.2.1.3.0

oracleidentity_management_suiteMatch12.2.1.4.0

oracleidentity_manager_connectorMatch9.1.0

oracleinstantis_enterprisetrackMatch17.1

oracleinstantis_enterprisetrackMatch17.2

oracleinstantis_enterprisetrackMatch17.3

oracleinsurance_data_gatewayMatch1.0.1

oracleinsurance_insbridge_rating_and_underwritingRange5.4–5.6.0.0

oracleinsurance_insbridge_rating_and_underwritingMatch5.2.0

oracleinsurance_insbridge_rating_and_underwritingMatch5.6.1.0

oraclejdeveloperMatch12.2.1.4.0

oraclemanaged_file_transferMatch12.2.1.3.0

oraclemanaged_file_transferMatch12.2.1.4.0

oraclemanagement_cloud_engineMatch1.5.0

oraclemysql_enterprise_monitorRange≤8.0.29

oraclepayment_interfaceMatch19.1

oraclepayment_interfaceMatch20.3

oraclepeoplesoft_enterprise_peopletoolsMatch8.58

oraclepeoplesoft_enterprise_peopletoolsMatch8.59

oracleprimavera_gatewayRange17.12.0–17.12.11

oracleprimavera_gatewayRange18.8.0–18.8.13

oracleprimavera_gatewayRange19.12.0–19.12.12

oracleprimavera_gatewayRange20.12.0–20.12.7

oracleprimavera_gatewayMatch21.12.0

oracleprimavera_p6_enterprise_project_portfolio_managementRange19.12.0.0–19.12.18.0

oracleprimavera_p6_enterprise_project_portfolio_managementRange20.12.0.0–20.12.12.0

oracleprimavera_p6_enterprise_project_portfolio_managementMatch21.12.0.0

oracleprimavera_unifierMatch18.8

oracleprimavera_unifierMatch19.12

oracleprimavera_unifierMatch20.12

oracleprimavera_unifierMatch21.12

oracleretail_back_officeMatch14.1

oracleretail_central_officeMatch14.1

oracleretail_customer_insightsMatch15.0.2

oracleretail_customer_insightsMatch16.0.2

oracleretail_data_extractor_for_merchandisingMatch15.0.2

oracleretail_data_extractor_for_merchandisingMatch16.0.2

oracleretail_eftlinkMatch16.0.3

oracleretail_eftlinkMatch17.0.2

oracleretail_eftlinkMatch18.0.1

oracleretail_eftlinkMatch19.0.1

oracleretail_eftlinkMatch20.0.1

oracleretail_eftlinkMatch21.0.0

oracleretail_financial_integrationRange16.0.1–16.0.3

oracleretail_financial_integrationMatch14.1.3.2

oracleretail_financial_integrationMatch15.0.3.1

oracleretail_financial_integrationMatch19.0.0

oracleretail_financial_integrationMatch19.0.1

oracleretail_integration_busRange16.0.1–16.0.3

oracleretail_integration_busRange19.0.0–19.0.1.0

oracleretail_integration_busMatch14.1.3

oracleretail_integration_busMatch14.1.3.2

oracleretail_integration_busMatch15.0.3.1

oracleretail_integration_busMatch19.0.0

oracleretail_integration_busMatch19.0.1

oracleretail_invoice_matchingMatch15.0.3

oracleretail_invoice_matchingMatch16.0.3

oracleretail_merchandising_systemMatch16.0.3

oracleretail_merchandising_systemMatch19.0.1

oracleretail_order_brokerMatch16.0

oracleretail_order_brokerMatch18.0

oracleretail_order_brokerMatch19.1

oracleretail_order_management_systemMatch19.5

oracleretail_point-of-serviceMatch14.1

oracleretail_predictive_application_serverMatch14.1.3.46

oracleretail_predictive_application_serverMatch15.0.3.115

oracleretail_predictive_application_serverMatch16.0.3.240

oracleretail_price_managementMatch13.2

oracleretail_price_managementMatch14.0.4

oracleretail_price_managementMatch14.1.3.0

oracleretail_price_managementMatch15.0.3.0

oracleretail_price_managementMatch16.0.3.0

oracleretail_returns_managementMatch14.1

oracleretail_service_backboneRange16.0.1–16.0.3

oracleretail_service_backboneMatch14.1.3

oracleretail_service_backboneMatch14.1.3.2

oracleretail_service_backboneMatch15.0.3.1

oracleretail_service_backboneMatch19.0.0

oracleretail_service_backboneMatch19.0.1

oracleretail_service_backboneMatch19.0.1.0

oracleretail_store_inventory_managementMatch14.0.4.13

oracleretail_store_inventory_managementMatch14.1.3.5

oracleretail_store_inventory_managementMatch14.1.3.14

oracleretail_store_inventory_managementMatch15.0.3.3

oracleretail_store_inventory_managementMatch15.0.3.8

oracleretail_store_inventory_managementMatch16.0.3.7

oraclesiebel_ui_frameworkRange≤21.12

oraclesql_developerRange<21.4.2

oracletaleo_platformRange<22.1

oracleutilities_frameworkRange4.3.0.1.0–4.3.0.6.0

oracleutilities_frameworkMatch4.4.0.0.0

oracleutilities_frameworkMatch4.4.0.2.0

oracleutilities_frameworkMatch4.4.0.3.0

oraclewebcenter_portalMatch12.2.1.3.0

oraclewebcenter_portalMatch12.2.1.4.0

oraclewebcenter_sitesMatch12.2.1.3.0

oraclewebcenter_sitesMatch12.2.1.4.0

oracleweblogic_serverMatch12.2.1.3.0

oracleweblogic_serverMatch12.2.1.4.0

oracleweblogic_serverMatch14.1.1.0.0

References

www.openwall.com/lists/oss-security/2021/12/19/1

cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf

logging.apache.org/log4j/2.x/security.html

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

security.netapp.com/advisory/ntap-20211218-0001/

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

www.debian.org/security/2021/dsa-5024

www.kb.cert.org/vuls/id/930724

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2022.html

www.zerodayinitiative.com/advisories/ZDI-21-1541/

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.966 High

EPSS

Percentile

99.6%

JSON

CVE-2021-45105

Affected configurations

References

Related