Apache log4j: Schwachstelle ermöglicht Denial of Service

Summary

Product

Vulnerabilities 1

• Medium 5.9
  CVE-2021-45105 Public exploit EPSS 100%

  Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

  Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 18, 2021

Revision history

1. 2025-11-05 #41

   Neue Updates von Dell aufgenommen

2. 2022-12-11 #40

   Neue Updates von Amazon aufgenommen

3. 2022-09-20 #39

   Neue Updates von HCL aufgenommen

4. 2022-08-14 #38

   Neue Updates von HCL aufgenommen

5. 2022-07-24 #37

   Neue Updates von HCL aufgenommen

6. 2022-05-17 #36

   Neue Updates von HCL aufgenommen

7. 2022-04-27 #35

   Neue Updates von HCL aufgenommen

8. 2022-04-26 #34

   Neue Updates von AVAYA aufgenommen

9. 2022-04-24 #33

   Neue Updates von HCL aufgenommen

10. 2022-04-20 #32

    Neue Updates von Red Hat aufgenommen

11. 2022-04-18 #31

    Neue Updates von IBM aufgenommen

12. 2022-04-11 #30

    Neue Updates von Red Hat aufgenommen

13. 2022-04-03 #29

    Neue Updates von IBM aufgenommen

14. 2022-03-29 #28

    Neue Updates von HCL aufgenommen

15. 2022-03-22 #27

    Neue Updates von IBM aufgenommen

16. 2022-02-01 #26

    Neue Updates von IBM aufgenommen

17. 2022-01-27 #25

    Neue Updates von IBM und EMC aufgenommen

18. 2022-01-26 #24

    Neue Updates von IBM aufgenommen

19. 2022-01-24 #23

    Neue Updates von IBM aufgenommen

20. 2022-01-23 #22

    Neue Updates von IBM aufgenommen

21. 2022-01-20 #21

    Neue Updates von Red Hat aufgenommen

22. 2022-01-19 #20

    Neue Updates von Red Hat aufgenommen

23. 2022-01-17 #19

    Neue Updates von IBM aufgenommen

24. 2022-01-16 #18

    Neue Updates von IBM aufgenommen

25. 2022-01-13 #17

    Neue Updates von IBM aufgenommen

References

• Apache Log4j Security Vulnerabilities vom 2021-12-17
  https://logging.apache.org/log4j/2.x/security.html
• Ubuntu Security Notice USN-5203-1
  https://ubuntu.com/security/notices/USN-5203-1
• Debian Security Advisory DSA-5024-1
  https://www.debian.org/security/2021/dsa-5024
• Citrix Security Advisory CTX335705
  https://support.citrix.com/article/CTX335705
• Cisco Security Advisory cisco-sa-apache-log4j-qRuKNEbd
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• GitHub Security Advisory GHSA-P6XC-XR62-6R2G
  https://github.com/advisories/GHSA-p6xc-xr62-6r2g
• PoC
  https://twitter.com/hack_git/status/1472455892503306243
• NetApp Security Advisory NTAP-20211218-0001
  https://security.netapp.com/advisory/ntap-20211218-0001/
• Siemens Security Advisory SSA-501673
  https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
• Cisco Security Advisory cisco-sa-apache-log4j-qRuKNEbd vom 2021-12-20
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• Apache Log4j 2 Release Notes
  https://logging.apache.org/log4j/log4j-2.12.3/index.html
• Apache Log4j2 Advisory
  https://logging.apache.org/log4j/log4j-2.3.1/index.html
• IBM Security Bulletin 6528672 vom 2021-12-22
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affects-some-features-of-ibm-db2-cve-2021-45046-cve-2021-45105/
• IBM Security Bulletin 6536870 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-log4j-affects-ibm-spss-analytic-server-cve-2021-45105-and-cve-2021-45046/
• IBM Security Bulletin 6536704 vom 2021-12-23
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affects-spss-collaboration-and-deployment-services/
• WIBU Security Advisory WIBU-211220-01 vom 2021-12-23
  https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-211220-01.pdf
• Amazon Linux Security Advisory ALAS-2021-008 vom 2021-12-24
  https://alas.aws.amazon.com/AL2022/ALAS-2021-008.html
• Amazon Linux Security Advisory ALAS-2021-1733 vom 2021-12-24
  https://alas.aws.amazon.com/AL2/ALAS-2021-1733.html
• IBM Security Bulletin 6537186 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-subscription/
• IBM Security Bulletin 6537184 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-server/
• IBM Security Bulletin 6537142 vom 2021-12-25
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-vulnerable-to-a-denial-of-service-vulnerability-in-apache-log4j2-component-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537182 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilities-cve-2021-45105-affecting-v2-16-and-cve-2021-45046-affecting-v2-15-affect-ibm-spss-statistics-desktop/
• Debian Security Advisory DLA-2852 vom 2021-12-26
  https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html
• IBM Security Bulletin 6537180 vom 2021-12-27
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spss-statistics-is-vulnerable-to-denial-of-service-due-to-apache-log4j-cve-2021-45105-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45046/
• IBM Security Bulletin 6537212 vom 2021-12-28
  https://www.ibm.com/blogs/psirt/security-bulletinibm-spss-modeler-is-vulnerable-to-denial-of-service-due-to-apache-log4j-cve-2021-45105-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45046/
• IBM Security Bulletin 6537240 vom 2021-12-28
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-operations-center-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537748 vom 2021-12-31
  https://www.ibm.com/support/pages/node/6537748
• IBM Security Bulletin 6537636 vom 2022-01-04
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-plus-container-backup-and-restore-for-kubernetes-and-openshift-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537634 vom 2022-01-04
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-impact-ibm-spectrum-protect-plus-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6538148 vom 2022-01-05
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affect-ibm-websphere-application-server-cve-2021-45105-cve-2021-44832/
• IBM Security Bulletin 6537640 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-for-space-management-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6538396 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-impacts-ibm-spectrum-protect-backup-archive-client-and-ibm-spectrum-protect-for-virtual-environments-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6537642 vom 2022-01-06
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-snapshot-on-windows-cve-2021-45105-and-cve-2021-45046/
• IBM Security Bulletin 6537644 vom 2022-01-07
  https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-log4j-affect-ibm-spectrum-protect-snapshot-for-vmware-cve-2021-45105-and-cve-2021-45046/
• JobScheduler Vulnerability Release 1.13.11 vom 2022-01-10
  https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.11
• EMC Security Advisory DSA-2021-274 vom 2022-01-09
  https://www.dell.com/support/kbdoc/de-de/000194503/dsa-2021-274-dell-emc-data-domain-security-update-for-apache-log4j-remote-code-execution-vulnerability-cve-2021-44228
• HPE Security Bulletin HPESBGN04215 rev.10 vom 2022-01-08
  https://support.hpe.com/hpesc/public/docDisplay?elq_mid=17739&elq_cid=67018031&docId=hpesbgn04215en_us
• Red Hat Security Advisory RHSA-2022:0044 vom 2022-01-10
  https://access.redhat.com/errata/RHSA-2022:0044
• Red Hat Security Advisory RHSA-2022:0042 vom 2022-01-10
  https://access.redhat.com/errata/RHSA-2022:0042
• Red Hat Security Advisory RHSA-2022:0043 vom 2022-01-10
  https://access.redhat.com/errata/RHSA-2022:0043
• Red Hat Security Advisory RHSA-2022:0047 vom 2022-01-10
  https://access.redhat.com/errata/RHSA-2022:0047
• IBM Security Bulletin 6539408 vom 2022-01-11
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-log4j-affect-the-ibm-websphere-application-server-and-ibm-security-guardium-key-lifecycle-manager-cve-2021-4104-cve-2021-45046-cve-2021-45105/
• Ubuntu Security Notice USN-5222-1 vom 2022-01-11
  https://ubuntu.com/security/notices/USN-5222-1
• IBM Security Bulletin 6538896 vom 2022-01-12
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-blockchain-bridge-dependencies-are-vulnerable-to-an-issue-in-apache-log4j-cve-2021-45105/
• Red Hat Security Advisory RHSA-2022:0026 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0026
• JobScheduler Vulnerability Release 2.2.1 vom 2022-01-11
  https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+2.2.1
• IBM Security Bulletin 6540542 vom 2022-01-14
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-business-automation-workflow-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-and-cve-2021-45046/
• IBM Security Advisory
  https://www.ibm.com/support/pages/node/6541182
• IBM Security Bulletin 6541258 vom 2022-01-18
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rational-software-architect-realtime-edition-rsa-rt-is-is-vulnerable-to-arbitrary-code-execution-and-denial-of-service-due-to-apache-log4j-cve-2021-44228-cve-2021-45046-and/
• Red Hat Security Advisory RHSA-2022:0203 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0203
• Red Hat Security Advisory RHSA-2022:0223 vom 2022-01-21
  https://access.redhat.com/errata/RHSA-2022:0223
• Red Hat Security Advisory RHSA-2022:0219 vom 2022-01-21
  https://access.redhat.com/errata/RHSA-2022:0219
• Red Hat Security Advisory RHSA-2022:0216 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0216
• Red Hat Security Advisory RHSA-2022:0205 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0205
• Red Hat Security Advisory RHSA-2022:0083 vom 2022-01-20
  https://access.redhat.com/errata/RHSA-2022:0083
• Red Hat Security Advisory RHSA-2022:0222 vom 2022-01-21
  https://access.redhat.com/errata/RHSA-2022:0222
• IBM Security Bulletin 6549764 vom 2022-01-22
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-information-server-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6550462 vom 2022-01-25
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-insights-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-cve-2021-45046/
• IBM Security Bulletin 6551118 vom 2022-01-27
  https://www.ibm.com/blogs/psirt/security-bulletinibm-db2-on-openshift-and-ibm-db2-and-db2-warehouse-on-cloud-pak-for-data-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache/
• IBM Security Bulletin 6551390 vom 2022-01-28
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-network-manager-ip-edition-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-and-cve-2021-45046/
• EMC Security Advisory DSA-2019-079 vom 2022-01-28
  https://www.dell.com/support/kbdoc/de-de/000194054/dsa-2019-079
• IBM Security Bulletin 6551310 vom 2022-01-28
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-omnibus-common-integration-libraries-is-vulnerable-to-arbitrary-code-execution-and-denial-of-service-due-to-apache-log4j-cve-2021-44228-cve-2021-45046-cve-2021/
• IBM Security Bulletin 6552546 vom 2022-02-02
  https://www.ibm.com/blogs/psirt/security-bulletin-tivoli-netcool-omnibus-installation-contains-vulnerable-apache-log4j-code-cve-2021-44832-cve-2021-45046-cve-2021-45105/
• IBM Security Bulletin 6565401 vom 2022-03-23
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-big-sql-is-vulnerable-to-arbitrary-code-execution-and-denial-of-service-due-to-apache-log4j-cve-2021-45046-cve-2021-45105/
• HCL Article KB0096807 vom 2022-03-29
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096807
• IBM Security Bulletin 6568843 vom 2022-04-02
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-informix-dynamic-server-in-cloud-pak-for-data-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-45105-cve-2021-45046/
• Red Hat Security Advisory RHSA-2022:1296 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1296
• Red Hat Security Advisory RHSA-2022:1297 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1297
• Red Hat Security Advisory RHSA-2022:1299 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1299
• IBM Security Bulletin 6572685 vom 2022-04-16
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-informix-dynamic-server-is-vulnerable-to-denial-of-service-cve-2021-45105-and-remote-code-execution-cve-2021-45046-due-to-apache-log4j/
• Red Hat Security Advisory RHSA-2022:1462 vom 2022-04-20
  https://access.redhat.com/errata/RHSA-2022:1462
• Red Hat Security Advisory RHSA-2022:1469 vom 2022-04-20
  https://access.redhat.com/errata/RHSA-2022:1469
• Red Hat Security Advisory RHSA-2022:1463 vom 2022-04-20
  https://access.redhat.com/errata/RHSA-2022:1463
• HCL Article KB0097650 vom 2022-04-23
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097650
• AVAYA Security Advisory ASA-2022-001 vom 2022-04-25
  https://downloads.avaya.com/css/P8/documents/101081576
• HCL Article KB0097787 vom 2022-04-28
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097787
• HCL Article KB0097471 vom 2022-05-18
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097471
• HCL Article KB0099128 vom 2022-07-24
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099128
• HCL Article KB0099671 vom 2022-07-24
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099671
• HCL Article KB0099131 vom 2022-07-24
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099131