Denial of Service Vulnerability in Apache Log4j2: Uncontrolled Recursion in Thread Context Map
Summary
CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. Affects apache-log4j2 across 3 version ranges.
< 2.17.0-1~deb11u1
< 02f8c6aee8df3cdc935e9bdd4f2d020306035dbe
>= 8d9204a4b4c6016fa6b36513a46502689d6a45c1, < 38513a7d57343881f7bf58f37e67d6a87e0a47c5
Fixed in 2.17.0-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Log4j2 is a popular logging library used in Java applications for logging purposes. It provides a flexible and efficient logging framework that allows developers to log messages in various formats and destinations. The library is widely adopted due to its performance and ease of use. However, certain versions of Log4j2 are vulnerable to a denial of service attack due to uncontrolled recursion in self-referential lookups, which can be exploited by attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2021-45105, affects Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1). It arises from the failure to protect against uncontrolled recursion when interpreting crafted strings in the Thread Context Map. An attacker who can control this data can trigger a denial of service, causing the application to become unresponsive. This vulnerability poses a significant risk, especially for applications that rely on user input for logging.
How To Fix
Minimum fixed version
2.17.0-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache-log4j2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize any user-controlled data before it is logged. This can help mitigate the risk of an attacker exploiting the vulnerability.
Conclusion
CVE-2021-45105 presents a significant risk to applications using vulnerable versions of Apache Log4j2. It is crucial to upgrade to the latest version to mitigate the risk of denial of service attacks. Additionally, using tools like Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for apache-log4j2 →
FAQ
CVE-2021-45105 is a vulnerability in Apache Log4j2 that allows for denial of service due to uncontrolled recursion in self-referential lookups.
Affected versions include Apache Log4j2 versions 2.0-alpha1 through 2.16.0, excluding 2.12.3 and 2.3.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2021-45105 is 5.9, indicating a moderate severity level.
If you cannot upgrade, implement input validation to sanitize user-controlled data before logging to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-log4j2.
