Apache Log4j2 Denial of Service Vulnerability (CNVD-2021-101661)

Log4j is an open source project from Apache. By using Log4j, you can control the destination of log messages delivered to the console, files, GUI components, or even socket servers, NT’s event logger, etc. A denial of service vulnerability exists in Apache Log4j2. The vulnerability is due to Apache Log4j2 configured with a non-default Pattern Layout scenario with Context Lookup (for example: $${ctx:loginId}), which can be exploited by attackers to construct malicious data to perform denial-of-service attacks without authorization, ultimately causing a server denial of service.