CVE-2021-45105 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

2021-12-1811:55:08

CWE-674

CWE-20

apache

www.cve.org

7.2 High

AI Score

Confidence

High

0.966 High

EPSS

Percentile

99.6%

JSON

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CNA Affected

[
  {
    "product": "Apache Log4j2",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "2.13.0",
            "status": "affected"
          },
          {
            "at": "2.12.3",
            "status": "unaffected"
          },
          {
            "at": "2.4",
            "status": "affected"
          },
          {
            "at": "2.3.1",
            "status": "unaffected"
          },
          {
            "at": "2.0-alpha1",
            "status": "affected"
          }
        ],
        "lessThan": "2.17.0",
        "status": "affected",
        "version": "log4j-core",
        "versionType": "custom"
      }
    ]
  }
]