← Back

CVE-2021-45105

nvd nist
Published: Dec 18, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected (208)

Products: Apache: Log4j · Netapp: Cloud Manager · Debian: Debian Linux · +2 more
Show all products
Apache: Log4j · Netapp: Cloud Manager · Debian: Debian Linux · Sonicwall: Email Security, Network Security Manager, Web Application Firewall, 6bk1602 0aa12 0tp0 Firmware, 6bk1602 0aa22 0tp0 Firmware, 6bk1602 0aa32 0tp0 Firmware, 6bk1602 0aa42 0tp0 Firmware, 6bk1602 0aa52 0tp0 Firmware · Oracle: Agile Engineering Data Management, Agile Plm, Agile Plm Mcad Connector, Autovue For Agile Product Lifecycle Management, Banking Deposits And Lines Of Credit Servicing, Banking Enterprise Default Management, Banking Loans Servicing, Banking Party Management, Banking Payments, Banking Platform, Banking Trade Finance, Banking Treasury Management, Business Intelligence, Communications Asap, Communications Billing And Revenue Management, Communications Cloud Native Core Console, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function, Communications Cloud Native Core Policy, Communications Cloud Native Core Security Edge Protection Proxy, Communications Cloud Native Core Service Communication Proxy, Communications Cloud Native Core Unified Data Repository, Communications Convergence, Communications Convergent Charging Controller, Communications Diameter Signaling Router, Communications Eagle Element Management System, Communications Eagle Ftp Table Base Retrieval, Communications Element Manager, Communications Evolved Communications Application Server, Communications Interactive Session Recorder, Communications Ip Service Activator, Communications Messaging Server, Communications Network Charging And Control, Communications Network Integrity, Communications Performance Intelligence Center, Communications Pricing Design Center, Communications Service Broker, Communications Services Gatekeeper, Communications Session Report Manager, Communications Session Route Manager, Communications Unified Inventory Management, Communications User Data Repository, Communications Webrtc Session Controller, Data Integrator, E Business Suite, Enterprise Manager Base Platform, Enterprise Manager For Peoplesoft, Enterprise Manager Ops Center, Financial Services Analytical Applications Infrastructure, Financial Services Model Management And Governance, Flexcube Universal Banking, Health Sciences Empirica Signal, Health Sciences Inform, Health Sciences Information Manager, Healthcare Data Repository, Healthcare Foundation, Healthcare Master Person Index, Healthcare Translational Research, Hospitality Suite8, Hospitality Token Proxy Service, Hyperion Bi+, Hyperion Data Relationship Management, Hyperion Infrastructure Technology, Hyperion Planning, Hyperion Profitability And Cost Management, Hyperion Tax Provision, Identity Management Suite, Identity Manager Connector, Instantis Enterprisetrack, Insurance Data Gateway, Insurance Insbridge Rating And Underwriting, Jdeveloper, Managed File Transfer, Management Cloud Engine, Mysql Enterprise Monitor, Payment Interface, Peoplesoft Enterprise Peopletools, Primavera Gateway, Primavera P6 Enterprise Project Portfolio Management, Primavera Unifier, Retail Back Office, Retail Central Office, Retail Customer Insights, Retail Data Extractor For Merchandising, Retail Eftlink, Retail Financial Integration, Retail Integration Bus, Retail Invoice Matching, Retail Merchandising System, Retail Order Broker, Retail Order Management System, Retail Point Of Service, Retail Predictive Application Server, Retail Price Management, Retail Returns Management, Retail Service Backbone, Retail Store Inventory Management, Siebel Ui Framework, Sql Developer, Taleo Platform, Utilities Framework, Webcenter Portal, Webcenter Sites, Weblogic Server
Apache
1 product
Log4j
Netapp
1 product
Cloud Manager
Debian
1 product
Debian Linux
Sonicwall
8 products
Email Security
Network Security Manager
Web Application Firewall
6bk1602 0aa12 0tp0 Firmware
6bk1602 0aa22 0tp0 Firmware
6bk1602 0aa32 0tp0 Firmware
6bk1602 0aa42 0tp0 Firmware
6bk1602 0aa52 0tp0 Firmware
Oracle
105 products
Agile Engineering Data Management
Agile Plm
Agile Plm Mcad Connector
Autovue For Agile Product Lifecycle Management
Banking Deposits And Lines Of Credit Servicing
Banking Enterprise Default Management
Banking Loans Servicing
Banking Party Management
Banking Payments
Banking Platform
Banking Trade Finance
Banking Treasury Management
Business Intelligence
Communications Asap
Communications Billing And Revenue Management
Communications Cloud Native Core Console
Communications Cloud Native Core Network Function Cloud Native Environment
Communications Cloud Native Core Network Repository Function
Communications Cloud Native Core Network Slice Selection Function
Communications Cloud Native Core Policy
Communications Cloud Native Core Security Edge Protection Proxy
Communications Cloud Native Core Service Communication Proxy
Communications Cloud Native Core Unified Data Repository
Communications Convergence
Communications Convergent Charging Controller
Communications Diameter Signaling Router
Communications Eagle Element Management System
Communications Eagle Ftp Table Base Retrieval
Communications Element Manager
Communications Evolved Communications Application Server
Communications Interactive Session Recorder
Communications Ip Service Activator
Communications Messaging Server
Communications Network Charging And Control
Communications Network Integrity
Communications Performance Intelligence Center
Communications Pricing Design Center
Communications Service Broker
Communications Services Gatekeeper
Communications Session Report Manager
Communications Session Route Manager
Communications Unified Inventory Management
Communications User Data Repository
Communications Webrtc Session Controller
Data Integrator
E Business Suite
Enterprise Manager Base Platform
Enterprise Manager For Peoplesoft
Enterprise Manager Ops Center
Financial Services Analytical Applications Infrastructure
Financial Services Model Management And Governance
Flexcube Universal Banking
Health Sciences Empirica Signal
Health Sciences Inform
Health Sciences Information Manager
Healthcare Data Repository
Healthcare Foundation
Healthcare Master Person Index
Healthcare Translational Research
Hospitality Suite8
Hospitality Token Proxy Service
Hyperion Bi+
Hyperion Data Relationship Management
Hyperion Infrastructure Technology
Hyperion Planning
Hyperion Profitability And Cost Management
Hyperion Tax Provision
Identity Management Suite
Identity Manager Connector
Instantis Enterprisetrack
Insurance Data Gateway
Insurance Insbridge Rating And Underwriting
Jdeveloper
Managed File Transfer
Management Cloud Engine
Mysql Enterprise Monitor
Payment Interface
Peoplesoft Enterprise Peopletools
Primavera Gateway
Primavera P6 Enterprise Project Portfolio Management
Primavera Unifier
Retail Back Office
Retail Central Office
Retail Customer Insights
Retail Data Extractor For Merchandising
Retail Eftlink
Retail Financial Integration
Retail Integration Bus
Retail Invoice Matching
Retail Merchandising System
Retail Order Broker
Retail Order Management System
Retail Point Of Service
Retail Predictive Application Server
Retail Price Management
Retail Returns Management
Retail Service Backbone
Retail Store Inventory Management
Siebel Ui Framework
Sql Developer
Taleo Platform
Utilities Framework
Webcenter Portal
Webcenter Sites
Weblogic Server
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Log4j
From 2.0 to 2.3.1
Log4j
From 2.13.0 to 2.16.0
Log4j
From 2.4 to 2.12.3
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Manager
All versions
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Configuration D
4 vulnerable
Vulnerable SoftwareAffected Versions
Email Security
Up to 10.0.12
Sonicwall
Network Security Manager
From 2.0 to 3.0
Network Security Manager
From 2.0 to 3.0
Web Application Firewall
From 3.0.0 to 3.1.0
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
6bk1602 0aa12 0tp0 Firmware
Before 2.7.0
Running on/withPlatform Versions
Sonicwall
6bk1602 0aa12 0tp0
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
6bk1602 0aa22 0tp0 Firmware
Before 2.7.0
Running on/withPlatform Versions
Sonicwall
6bk1602 0aa22 0tp0
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
6bk1602 0aa32 0tp0 Firmware
Before 2.7.0
Running on/withPlatform Versions
Sonicwall
6bk1602 0aa32 0tp0
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
6bk1602 0aa42 0tp0 Firmware
Before 2.7.0
Running on/withPlatform Versions
Sonicwall
6bk1602 0aa42 0tp0
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
6bk1602 0aa52 0tp0 Firmware
Before 2.7.0
Running on/withPlatform Versions
Sonicwall
6bk1602 0aa52 0tp0
All versions
Configuration J
193 vulnerable
Vulnerable SoftwareAffected Versions
Agile Engineering Data Management
Version 6.2.1.0
Agile Plm
Version 9.3.6
Agile Plm Mcad Connector
Version 3.6
Autovue For Agile Product Lifecycle Management
Version 21.0.2
Banking Deposits And Lines Of Credit Servicing
Version 2.12.0
Oracle
Banking Enterprise Default Management
Version 2.12.0
Banking Enterprise Default Management
Version 2.7.1
Banking Loans Servicing
Version 2.12.0
Banking Party Management
Version 2.7.0
Banking Payments
Version 14.5
Oracle
Banking Platform
Version 2.12.0
Banking Platform
Version 2.6.2
Banking Platform
Version 2.7.1
Banking Trade Finance
Version 14.5
Banking Treasury Management
Version 14.5
Business Intelligence
Version 5.5.0.0.0
Communications Asap
Version 7.3
Oracle
Communications Billing And Revenue Management
Version 12.0.0.4
Communications Billing And Revenue Management
Version 12.0.0.5
Communications Cloud Native Core Console
Version 1.9.0
Communications Cloud Native Core Network Function Cloud Native Environment
Version 1.10.0
Oracle
Communications Cloud Native Core Network Repository Function
Version 1.15.0
Communications Cloud Native Core Network Repository Function
Version 1.15.1
Communications Cloud Native Core Network Slice Selection Function
Version 1.8.0
Communications Cloud Native Core Policy
Version 1.15.0
Communications Cloud Native Core Security Edge Protection Proxy
Version 1.7.0
Communications Cloud Native Core Service Communication Proxy
Version 1.15.0
Communications Cloud Native Core Unified Data Repository
Version 1.15.0
Oracle
Communications Convergence
Version 3.0.2.2.0
Communications Convergence
Version 3.0.3.0
Oracle
Communications Convergent Charging Controller
From 12.0.1.0.0 to 12.0.4.0.0
Communications Convergent Charging Controller
Version 6.0.1.0.0
Communications Diameter Signaling Router
From 8.3.0.0 to 8.5.1.0
Communications Eagle Element Management System
Version 46.6
Communications Eagle Ftp Table Base Retrieval
Version 4.5
Communications Element Manager
Before 9.0
Communications Evolved Communications Application Server
Version 7.1
Oracle
Communications Interactive Session Recorder
Version 6.3
Communications Interactive Session Recorder
Version 6.4
Communications Ip Service Activator
Version 7.4.0
Communications Messaging Server
Version 8.1
Oracle
Communications Network Charging And Control
From 12.0.1.0.0 to 12.0.4.0.0
Communications Network Charging And Control
Version 6.0.1.0.0
Communications Network Integrity
Version 7.3.6
Communications Performance Intelligence Center
Version 10.4.0.3
Oracle
Communications Pricing Design Center
Version 12.0.0.4
Communications Pricing Design Center
Version 12.0.0.5
Communications Service Broker
Version 6.2
Communications Services Gatekeeper
Version 7.0
Communications Session Report Manager
Before 9.0
Communications Session Route Manager
Before 9.0
Oracle
Communications Unified Inventory Management
Version 7.3.5
Communications Unified Inventory Management
Version 7.4.1
Communications Unified Inventory Management
Version 7.4.2
Communications User Data Repository
Version 12.4
Oracle
Communications Webrtc Session Controller
Version 7.2.0.0
Communications Webrtc Session Controller
Version 7.2.1
Oracle
Data Integrator
Version 12.2.1.3.0
Data Integrator
Version 12.2.1.4.0
E Business Suite
Version 12.2
Oracle
Enterprise Manager Base Platform
Version 13.4.0.0
Enterprise Manager Base Platform
Version 13.5.0.0
Oracle
Enterprise Manager For Peoplesoft
Version 13.4.1.1
Enterprise Manager For Peoplesoft
Version 13.5.1.1
Enterprise Manager Ops Center
Version 12.4.0.0
Financial Services Analytical Applications Infrastructure
From 8.0.7 to 8.1.1
Oracle
Financial Services Model Management And Governance
Version 8.0.8.0.0
Financial Services Model Management And Governance
Version 8.1.0.0.0
Financial Services Model Management And Governance
Version 8.1.1.0.0
Oracle
Flexcube Universal Banking
From 12.1.0 to 12.4
Flexcube Universal Banking
From 14.0.0 to 14.3.0
Flexcube Universal Banking
Version 11.83.3
Flexcube Universal Banking
Version 14.5
Oracle
Health Sciences Empirica Signal
Version 9.1.0.6
Health Sciences Empirica Signal
Version 9.2.0.0
Oracle
Health Sciences Inform
Version 6.2.1.1
Health Sciences Inform
Version 6.3.2.1
Health Sciences Inform
Version 7.0.0.0
Health Sciences Information Manager
From 3.0.1 to 3.0.4
Healthcare Data Repository
Version 8.1.1
Healthcare Foundation
From 7.3.0.1 to 7.3.0.4
Healthcare Master Person Index
Version 5.0.1
Oracle
Healthcare Translational Research
Version 4.1.0
Healthcare Translational Research
Version 4.1.1
Oracle
Hospitality Suite8
Version 8.13.0
Hospitality Suite8
Version 8.14.0
Hospitality Token Proxy Service
Version 19.2
Hyperion Bi+
Before 11.2.8.0
Hyperion Data Relationship Management
Before 11.2.8.0
Hyperion Infrastructure Technology
Before 11.2.8.0
Hyperion Planning
Before 11.2.8.0
Hyperion Profitability And Cost Management
Before 11.2.8.0
Hyperion Tax Provision
Before 11.2.8.0
Oracle
Identity Management Suite
Version 12.2.1.3.0
Identity Management Suite
Version 12.2.1.4.0
Identity Manager Connector
Version 9.1.0
Oracle
Instantis Enterprisetrack
Version 17.1
Instantis Enterprisetrack
Version 17.2
Instantis Enterprisetrack
Version 17.3
Insurance Data Gateway
Version 1.0.1
Oracle
Insurance Insbridge Rating And Underwriting
From 5.4 to 5.6.0.0
Insurance Insbridge Rating And Underwriting
Version 5.2.0
Insurance Insbridge Rating And Underwriting
Version 5.6.1.0
Jdeveloper
Version 12.2.1.4.0
Oracle
Managed File Transfer
Version 12.2.1.3.0
Managed File Transfer
Version 12.2.1.4.0
Management Cloud Engine
Version 1.5.0
Mysql Enterprise Monitor
Up to 8.0.29
Oracle
Payment Interface
Version 19.1
Payment Interface
Version 20.3
Oracle
Peoplesoft Enterprise Peopletools
Version 8.58
Peoplesoft Enterprise Peopletools
Version 8.59
Oracle
Primavera Gateway
From 17.12.0 to 17.12.11
Primavera Gateway
From 18.8.0 to 18.8.13
Primavera Gateway
From 19.12.0 to 19.12.12
Primavera Gateway
From 20.12.0 to 20.12.7
Primavera Gateway
Version 21.12.0
Oracle
Primavera P6 Enterprise Project Portfolio Management
From 19.12.0.0 to 19.12.18.0
Primavera P6 Enterprise Project Portfolio Management
From 20.12.0.0 to 20.12.12.0
Primavera P6 Enterprise Project Portfolio Management
Version 21.12.0.0
Oracle
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Primavera Unifier
Version 20.12
Primavera Unifier
Version 21.12
Retail Back Office
Version 14.1
Retail Central Office
Version 14.1
Oracle
Retail Customer Insights
Version 15.0.2
Retail Customer Insights
Version 16.0.2
Oracle
Retail Data Extractor For Merchandising
Version 15.0.2
Retail Data Extractor For Merchandising
Version 16.0.2
Oracle
Retail Eftlink
Version 16.0.3
Retail Eftlink
Version 17.0.2
Retail Eftlink
Version 18.0.1
Retail Eftlink
Version 19.0.1
Retail Eftlink
Version 20.0.1
Retail Eftlink
Version 21.0.0
Oracle
Retail Financial Integration
From 16.0.1 to 16.0.3
Retail Financial Integration
Version 14.1.3.2
Retail Financial Integration
Version 15.0.3.1
Retail Financial Integration
Version 19.0.0
Retail Financial Integration
Version 19.0.1
Oracle
Retail Integration Bus
From 16.0.1 to 16.0.3
Retail Integration Bus
From 19.0.0 to 19.0.1.0
Retail Integration Bus
Version 14.1.3.2
Retail Integration Bus
Version 14.1.3
Retail Integration Bus
Version 15.0.3.1
Retail Integration Bus
Version 19.0.0
Retail Integration Bus
Version 19.0.1
Oracle
Retail Invoice Matching
Version 15.0.3
Retail Invoice Matching
Version 16.0.3
Oracle
Retail Merchandising System
Version 16.0.3
Retail Merchandising System
Version 19.0.1
Oracle
Retail Order Broker
Version 16.0
Retail Order Broker
Version 18.0
Retail Order Broker
Version 19.1
Retail Order Management System
Version 19.5
Retail Point Of Service
Version 14.1
Oracle
Retail Predictive Application Server
Version 14.1.3.46
Retail Predictive Application Server
Version 15.0.3.115
Retail Predictive Application Server
Version 16.0.3.240
Oracle
Retail Price Management
Version 13.2
Retail Price Management
Version 14.0.4
Retail Price Management
Version 14.1.3.0
Retail Price Management
Version 15.0.3.0
Retail Price Management
Version 16.0.3.0
Retail Returns Management
Version 14.1
Oracle
Retail Service Backbone
From 16.0.1 to 16.0.3
Retail Service Backbone
Version 14.1.3.2
Retail Service Backbone
Version 14.1.3
Retail Service Backbone
Version 15.0.3.1
Retail Service Backbone
Version 19.0.0
Retail Service Backbone
Version 19.0.1.0
Retail Service Backbone
Version 19.0.1
Oracle
Retail Store Inventory Management
Version 14.0.4.13
Retail Store Inventory Management
Version 14.1.3.14
Retail Store Inventory Management
Version 14.1.3.5
Retail Store Inventory Management
Version 15.0.3.3
Retail Store Inventory Management
Version 15.0.3.8
Retail Store Inventory Management
Version 16.0.3.7
Siebel Ui Framework
Up to 21.12
Sql Developer
Before 21.4.2
Taleo Platform
Before 22.1
Oracle
Utilities Framework
From 4.3.0.1.0 to 4.3.0.6.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0
Utilities Framework
Version 4.4.0.3.0
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0
Oracle
Webcenter Sites
Version 12.2.1.3.0
Webcenter Sites
Version 12.2.1.4.0
Oracle
Weblogic Server
Version 12.2.1.3.0
Weblogic Server
Version 12.2.1.4.0
Weblogic Server
Version 14.1.1.0.0

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (26)

Source: security@apache.org
Mailing ListMitigationThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Release NotesVendor Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party AdvisoryUS Government Resource
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListMitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry

Timeline

No history available yet.