Apache log4j: Schwachstelle ermöglicht Codeausführung

Summary

Product

Vulnerabilities 1

• Critical 9.0
  CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 14, 2021

  KEV May 1, 2023

Revision history

1. 2025-11-05 #46

   Neue Updates von Dell aufgenommen

2. 2025-02-23 #45

   Neue Updates von Red Hat aufgenommen

3. 2022-12-11 #44

   Neue Updates von Amazon aufgenommen

4. 2022-09-20 #43

   Neue Updates von HCL aufgenommen

5. 2022-08-14 #42

   Neue Updates von HCL aufgenommen

6. 2022-07-24 #41

   Neue Updates von HCL aufgenommen

7. 2022-06-16 #40

   Neue Updates von Amazon aufgenommen

8. 2022-05-17 #39

   Neue Updates von HCL aufgenommen

9. 2022-04-27 #38

   Neue Updates von HCL aufgenommen

10. 2022-04-26 #37

    Neue Updates von AVAYA aufgenommen

11. 2022-04-24 #36

    Neue Updates von HCL aufgenommen

12. 2022-04-18 #35

    Neue Updates von IBM aufgenommen

13. 2022-04-11 #34

    Neue Updates von Red Hat aufgenommen

14. 2022-04-03 #33

    Neue Updates von IBM aufgenommen

15. 2022-03-29 #32

    Neue Updates von HCL aufgenommen

16. 2022-03-24 #31

    Neue Updates von HCL aufgenommen

17. 2022-03-22 #30

    Neue Updates von IBM aufgenommen

18. 2022-02-03 #29

    Neue Updates von Red Hat aufgenommen

19. 2022-02-01 #28

    Neue Updates von IBM aufgenommen

20. 2022-01-27 #27

    Neue Updates von IBM und EMC aufgenommen

21. 2022-01-26 #26

    Neue Updates von IBM aufgenommen

22. 2022-01-24 #25

    Neue Updates von IBM aufgenommen

23. 2022-01-23 #24

    Neue Updates von IBM aufgenommen

24. 2022-01-20 #23

    Neue Updates von Red Hat aufgenommen

25. 2022-01-19 #22

    Neue Updates von Red Hat aufgenommen

References

• Apache Log4j Security Vulnerabilities vom 2021-12-13
  https://logging.apache.org/log4j/2.x/security.html
• Lunasec Blog "Log4Shell Update" vom 2021-12-14
  https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/
• HCL Article KB0095516 vom 2021-12-16
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095516
• Red Hat Security Advisory RHSA-2021:5148 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5148
• Ubuntu Security Notice USN-5197-1 vom 2021-12-15
  https://ubuntu.com/security/notices/USN-5197-1
• Red Hat Security Advisory RHSA-2021:5106 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5106
• Amazon Linux Security Advisory ALAS-2021-1730 vom 2021-12-16
  https://alas.aws.amazon.com/AL2/ALAS-2021-1730.html
• IBM Security Bulletin 6526750 vom 2021-12-16
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affect-the-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-cve-2021-4104-cve-2021-45046/
• Debian Security Advisory DSA-5022 vom 2021-12-16
  https://lists.debian.org/debian-security-announce/2021/msg00208.html
• CloudFlare Blog vom 2021-12-16
  https://blog.cloudflare.com/protection-against-cve-2021-45046-the-additional-log4j-rce-vulnerability/
• Red Hat Security Advisory RHSA-2021:5186 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5186
• Cisco Security Advisory CISCO-SA-APACHE-LOG4J-QRUKNEBD vom 2021-12-17
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• Red Hat Security Advisory RHSA-2021:5183 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5183
• Red Hat Security Advisory RHSA-2021:5184 vom 2021-12-17
  https://access.redhat.com/errata/RHSA-2021:5184
• Red Hat Security Advisory RHSA-2021:5141 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5141
• Siemens Security Advisory SSA-714170 vom 2021-12-16
  https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
• Red Hat Security Advisory RHSA-2021:5107 vom 2021-12-16
  https://access.redhat.com/errata/RHSA-2021:5107
• Log4j Vulnerabilities Impact On Oracle E-Business Suite Analysis
  https://www.integrigy.com/security-resources/log4j-vulnerabilities-impact-oracle-e-business-suite-analysis
• Apache Log4j Security Vulnerabilities vom 2021-12-16
  https://logging.apache.org/log4j/2.x/security
• Apache Log4j Security Vulnerabilities vom 2021-12-16
  https://logging.apache.org/log4j/2.x/security.html
• Tibco Apache Log4J Vulnerability Daily Update
  https://www.tibco.com/support/notices/2021/12/apache-log4j-vulnerability-update-archive-6
• Atos Security Advisory Report - OBSO-2112-01
  https://networks.unify.com/security/advisories/OBSO-2112-01.pdf
• Avaya Product Security Apache Log4J Vulnerability vom 2021-12-17
  https://support.avaya.com/helpcenter/getGenericDetails?detailId=1399839287609
• Amazon Linux Security Advisory ALAS-2021-1553 vom 2021-12-18
  https://alas.aws.amazon.com/ALAS-2021-1553.html
• Amazon Linux Security Advisory ALASCORRETTO8-2021-001 vom 2021-12-20
  https://alas.aws.amazon.com/AL2/ALASCORRETTO8-2021-001.html
• IBM Security Bulletin 6527924 vom 2021-12-17
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-blockchain-bridge-dependencies-are-vulnerable-to-an-issue-in-apache-log4j-cve-2021-45046/
• Amazon Linux Security Advisory ALASJAVA-OPENJDK11-2021-001 vom 2021-12-20
  https://alas.aws.amazon.com/AL2/ALASJAVA-OPENJDK11-2021-001.html
• HCL Article KB0095587 vom 2021-12-17
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095587
• Citrix Security Advisory CTX335705 vom 2021-12-20
  https://support.citrix.com/article/CTX335705
• Amazon Linux Security Advisory ALAS-2021-1731 vom 2021-12-18
  https://alas.aws.amazon.com/AL2/ALAS-2021-1731.html
• Amazon Linux Security Advisory ALAS-2021-004 vom 2021-12-18
  https://alas.aws.amazon.com/AL2022/ALAS-2021-004.html
• IBM Security Bulletin 6528372 vom 2021-12-21
  https://www.ibm.com/blogs/psirt/security-bulletin-log4shell-vulnerability-affects-ibm-spss-statistics-cve-2021-45046/
• NetApp Security Advisory NTAP-20211215-0001 vom 2021-12-20
  https://security.netapp.com/advisory/ntap-20211215-0001/
• Apache Log4j 2 Release Notes
  https://logging.apache.org/log4j/log4j-2.12.3/index.html
• IBM Security Bulletin 6528672 vom 2021-12-22
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affects-some-features-of-ibm-db2-cve-2021-45046-cve-2021-45105/
• Incident Report for F-Secure services
  https://status.f-secure.com/incidents/sk8vmr0h34pd
• Apache Log4j2 Advisory
  https://logging.apache.org/log4j/log4j-2.3.1/index.html
• IBM Security Bulletin 6529162 vom 2021-12-22
  https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-log4j-cve-2021-45046-impacts-ibm-qradar-user-behavior-analytics-add-on-to-ibm-qradar-siem/
• IBM Security Bulletin 6536704 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affects-spss-collaboration-and-deployment-services/
• IBM Security Bulletin 6536870 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-ibm-spss-analytic-server-cve-2021-45105-and-cve-2021-45046/
• IBM Security Bulletin 6536868 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-apache-log4j-shipped-with-ibm-tivoli-netcool-omnibus-common-integration-libraries-cve-2021-4104-cve-2021-45046-cve-2021-44228/
• WIBU Security Advisory WIBU-211215-01 vom 2021-12-23
  https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-211215-01.pdf
• IBM Security Bulletin 6537184 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-server/
• IBM Security Bulletin 6537182 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-desktop/
• IBM Security Bulletin 6537186 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-subscription/
• IBM Security Bulletin 6537142 vom 2021-12-25
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-vulnerable-to-a-denial-of-service-vulnerability-in-apache-log4j2-component-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537180 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spss-statistics-is-vulnerable-to-denial-of-service-due-to-apache-log4j-cve-2021-45105-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45046/
• IBM Security Bulletin 6537212 vom 2021-12-28
  https://www.ibm.com/blogs/psirt/security-bulletinibm-spss-modeler-is-vulnerable-to-denial-of-service-due-to-apache-log4j-cve-2021-45105-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45046/
• IBM Security Bulletin 6537240 vom 2021-12-28
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-operations-center-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537748 vom 2021-12-31
  https://www.ibm.com/support/pages/node/6537748
• IBM Security Bulletin 6537636 vom 2022-01-04
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-plus-container-backup-and-restore-for-kubernetes-and-openshift-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537634 vom 2022-01-04
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-impact-ibm-spectrum-protect-plus-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6538396 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-impacts-ibm-spectrum-protect-backup-archive-client-and-ibm-spectrum-protect-for-virtual-environments-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537642 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-snapshot-on-windows-cve-2021-45105-and-cve-2021-45046/
• IBM Security Bulletin 6537640 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-for-space-management-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537644 vom 2022-01-07
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-snapshot-for-vmware-cve-2021-45105-and-cve-2021-45046/
• EMC Security Advisory DSA-2021-274 vom 2022-01-09
  https://www.dell.com/support/kbdoc/de-de/000194503/dsa-2021-274-dell-emc-data-domain-security-update-for-apache-log4j-remote-code-execution-vulnerability-cve-2021-44228
• EMC Security Advisory DSA-2021-309 vom 2022-01-09
  https://www.dell.com/support/kbdoc/de-de/000194651/dsa-2021-309-dell-emc-dpa-security-update-for-apache-log4j-remote-code-execution-vulnerability-cve-2021-44228
• EMC Security Advisory DSA-2021-277 vom 2022-01-09
  https://www.dell.com/support/kbdoc/de-de/000194480/dsa-2021-277-dell-emc-avamar-update-for-apache-log4j-remote-code-execution-vulnerability-cve-2021-44228
• HPE Security Bulletin HPESBGN04215 rev.10 vom 2022-01-08
  https://support.hpe.com/hpesc/public/docDisplay?elq_mid=17739&elq_cid=67018031&docId=hpesbgn04215en_us
• IBM Security Bulletin 6539408 vom 2022-01-11
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affect-the-ibm-websphere-application-server-and-ibm-security-guardium-key-lifecycle-manager-cve-2021-4104-cve-2021-45046-cve-2021-45105/
• IBM Security Bulletin 6538896 vom 2022-01-12
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-blockchain-bridge-dependencies-are-vulnerable-to-an-issue-in-apache-log4j-cve-2021-45105/
• Juniper Security Bulletin JSA11287 vom 2022-01-12
  https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11287&cat=SIRT_1
• SoapUI Release 5.6.1
  https://www.soapui.org/downloads/latest-release/release-history/
• JobScheduler Vulnerability Release 2.2.1 vom 2022-01-11
  https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+2.2.1
• IBM Security Bulletin 6540542 vom 2022-01-14
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-business-automation-workflow-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-and-cve-2021-45046/
• IBM Security Advisory
  https://www.ibm.com/support/pages/node/6541182
• IBM Security Bulletin 6541258 vom 2022-01-18
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rational-software-architect-realtime-edition-rsa-rt-is-is-vulnerable-to-arbitrary-code-execution-and-denial-of-service-due-to-apache-log4j-cve-2021-44228-cve-2021-45046-and/
• Red Hat Security Advisory RHSA-2022:0203 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0203
• Red Hat Security Advisory RHSA-2022:0223 vom 2022-01-21
  https://access.redhat.com/errata/RHSA-2022:0223
• Red Hat Security Advisory RHSA-2022:0083 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0083
• Red Hat Security Advisory RHSA-2022:0205 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0205
• Red Hat Security Advisory RHSA-2022:0216 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0216
• Red Hat Security Advisory RHSA-2022:0222 vom 2022-01-21
  https://access.redhat.com/errata/RHSA-2022:0222
• IBM Security Bulletin 6549764 vom 2022-01-22
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-information-server-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6550462 vom 2022-01-25
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-insights-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6551118 vom 2022-01-27
  https://www.ibm.com/blogs/psirt/security-bulletinibm-db2-on-openshift-and-ibm-db2-and-db2-warehouse-on-cloud-pak-for-data-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache/
• IBM Security Bulletin 6551310 vom 2022-01-28
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-omnibus-common-integration-libraries-is-vulnerable-to-arbitrary-code-execution-and-denial-of-service-due-to-apache-log4j-cve-2021-44228-cve-2021-45046-cve-2021/
• EMC Security Advisory DSA-2019-079 vom 2022-01-28
  https://www.dell.com/support/kbdoc/de-de/000194054/dsa-2019-079
• IBM Security Bulletin 6551390 vom 2022-01-28
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-network-manager-ip-edition-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-and-cve-2021-45046/