Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

MÉDIO 5.9CVE-2021-45105 · GHSA-p6xc-xr62-6r2g · Published 18/12/2021 · updated 25/08/2026

Em resumo

CVE-2021-45105 é uma vulnerabilidade MÉDIO (CVSS 5.9) que afeta org.apache.logging.log4j:log4j-core, org.ops4j.pax.logging:pax-logging-log4j2, log4j (apache).
Chance de exploração nos próximos 30 dias (EPSS): 100.0%, maior que 100.0% das vulnerabilidades.
Correção: atualize para 2.17.0, 2.12.3, 2.3.1, 1.10.9 ou posterior.

Package	Affected versions	Patched versions
org.apache.logging.log4j:log4j-core Maven	`≥ 2.13.0, < 2.17.0≥ 2.4.0, < 2.12.3< 2.3.1`	`2.17.02.12.32.3.1`
org.ops4j.pax.logging:pax-logging-log4j2 Maven	`≥ 1.10.0, < 1.10.9≥ 1.11.0, < 1.11.12≥ 1.8.0, < 1.9.2≥ 2.0.0, < 2.0.13`	`1.10.91.11.121.9.22.0.13`
log4j apache	`≥ 2.0, < 2.3.1≥ 2.13.0, ≤ 2.16.0≥ 2.4, < 2.12.3`	`2.3.12.12.3`
agile engineering data management oracle	`= 6.2.1.0`	No fix yet
agile plm mcad connector oracle	`= 3.6`	No fix yet
agile product lifecycle management oracle	`= 9.3.6`	No fix yet
autovue for agile product lifecycle management oracle	`= 21.0.2`	No fix yet
banking deposits and lines of credit servicing oracle	`= 2.12.0`	No fix yet
banking enterprise default management oracle	`= 2.12.0= 2.7.1`	No fix yet
banking loans servicing oracle	`= 2.12.0`	No fix yet
banking party management oracle	`= 2.7.0`	No fix yet
banking payments oracle	`= 14.5`	No fix yet
banking platform oracle	`= 2.12.0= 2.6.2= 2.7.1`	No fix yet
banking trade finance oracle	`= 14.5`	No fix yet
banking treasury management oracle	`= 14.5`	No fix yet
business intelligence oracle	`= 5.5.0.0.0`	No fix yet
communications asap oracle	`= 7.3`	No fix yet
communications billing and revenue management oracle	`= 12.0.0.4= 12.0.0.5`	No fix yet
communications cloud native core console oracle	`= 1.9.0`	No fix yet
communications cloud native core network function cloud native environment oracle	`= 1.10.0`	No fix yet
communications cloud native core network repository function oracle	`= 1.15.0= 1.15.1`	No fix yet
communications cloud native core network slice selection function oracle	`= 1.8.0`	No fix yet
communications cloud native core policy oracle	`= 1.15.0`	No fix yet
communications cloud native core security edge protection proxy oracle	`= 1.7.0`	No fix yet
communications cloud native core service communication proxy oracle	`= 1.15.0`	No fix yet
communications cloud native core unified data repository oracle	`= 1.15.0`	No fix yet
communications convergence oracle	`= 3.0.2.2.0= 3.0.3.0`	No fix yet
communications convergent charging controller oracle	`= 6.0.1.0.0≥ 12.0.1.0.0, ≤ 12.0.4.0.0`	No fix yet
communications diameter signaling router oracle	`≥ 8.3.0.0, ≤ 8.5.1.0`	No fix yet
communications eagle element management system oracle	`= 46.6`	No fix yet
communications eagle ftp table base retrieval oracle	`= 4.5`	No fix yet
communications element manager oracle	`< 9.0`	`9.0`
communications evolved communications application server oracle	`= 7.1`	No fix yet
communications interactive session recorder oracle	`= 6.3= 6.4`	No fix yet
communications ip service activator oracle	`= 7.4.0`	No fix yet
communications messaging server oracle	`= 8.1`	No fix yet
communications network charging and control oracle	`= 6.0.1.0.0≥ 12.0.1.0.0, ≤ 12.0.4.0.0`	No fix yet
communications network integrity oracle	`= 7.3.6`	No fix yet
communications performance intelligence center oracle	`= 10.4.0.3`	No fix yet
communications pricing design center oracle	`= 12.0.0.4= 12.0.0.5`	No fix yet
communications service broker oracle	`= 6.2`	No fix yet
communications services gatekeeper oracle	`= 7.0`	No fix yet
communications session report manager oracle	`< 9.0`	`9.0`
communications session route manager oracle	`< 9.0`	`9.0`
communications unified inventory management oracle	`= 7.3.5= 7.4.1= 7.4.2`	No fix yet
communications user data repository oracle	`= 12.4`	No fix yet
communications webrtc session controller oracle	`= 7.2.0.0= 7.2.1`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
e-business suite oracle	`= 12.2`	No fix yet
enterprise manager base platform oracle	`= 13.4.0.0= 13.5.0.0`	No fix yet
enterprise manager for peoplesoft oracle	`= 13.4.1.1= 13.5.1.1`	No fix yet
enterprise manager ops center oracle	`= 12.4.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.7, ≤ 8.1.1`	No fix yet
financial services model management and governance oracle	`= 8.0.8.0.0= 8.1.0.0.0= 8.1.1.0.0`	No fix yet
flexcube universal banking oracle	`= 11.83.3= 14.5≥ 12.1.0, ≤ 12.4≥ 14.0.0, ≤ 14.3.0`	No fix yet
health sciences empirica signal oracle	`= 9.1.0.6= 9.2.0.0`	No fix yet
health sciences inform oracle	`= 6.2.1.1= 6.3.2.1= 7.0.0.0`	No fix yet
health sciences information manager oracle	`≥ 3.0.1, ≤ 3.0.4`	No fix yet
healthcare data repository oracle	`= 8.1.1`	No fix yet
healthcare foundation oracle	`≥ 7.3.0.1, ≤ 7.3.0.4`	No fix yet
healthcare master person index oracle	`= 5.0.1`	No fix yet
healthcare translational research oracle	`= 4.1.0= 4.1.1`	No fix yet
hospitality suite8 oracle	`= 8.13.0= 8.14.0`	No fix yet
hospitality token proxy service oracle	`= 19.2`	No fix yet
hyperion bi+ oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion data relationship management oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion infrastructure technology oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion planning oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion profitability and cost management oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion tax provision oracle	`< 11.2.8.0`	`11.2.8.0`
identity management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
identity manager connector oracle	`= 9.1.0`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance data gateway oracle	`= 1.0.1`	No fix yet
insurance insbridge rating and underwriting oracle	`= 5.2.0= 5.6.1.0≥ 5.4, ≤ 5.6.0.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
managed file transfer oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
management cloud engine oracle	`= 1.5.0`	No fix yet
mysql enterprise monitor oracle	`≤ 8.0.29`	No fix yet
payment interface oracle	`= 19.1= 20.3`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.58= 8.59`	No fix yet
primavera gateway oracle	`= 21.12.0≥ 17.12.0, ≤ 17.12.11≥ 18.8.0, ≤ 18.8.13≥ 19.12.0, ≤ 19.12.12≥ 20.12.0, ≤ 20.12.7`	No fix yet
primavera p6 enterprise project portfolio management oracle	`= 21.12.0.0≥ 19.12.0.0, ≤ 19.12.18.0≥ 20.12.0.0, ≤ 20.12.12.0`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12= 21.12`	No fix yet
retail back office oracle	`= 14.1`	No fix yet
retail central office oracle	`= 14.1`	No fix yet
retail customer insights oracle	`= 15.0.2= 16.0.2`	No fix yet
retail data extractor for merchandising oracle	`= 15.0.2= 16.0.2`	No fix yet
retail eftlink oracle	`= 16.0.3= 17.0.2= 18.0.1= 19.0.1= 20.0.1= 21.0.0`	No fix yet
retail financial integration oracle	`= 14.1.3.2= 15.0.3.1= 19.0.0= 19.0.1≥ 16.0.1, ≤ 16.0.3`	No fix yet
retail integration bus oracle	`= 14.1.3= 14.1.3.2= 15.0.3.1= 19.0.0= 19.0.1≥ 16.0.1, ≤ 16.0.3≥ 19.0.0, ≤ 19.0.1.0`	No fix yet
retail invoice matching oracle	`= 15.0.3= 16.0.3`	No fix yet
retail merchandising system oracle	`= 16.0.3= 19.0.1`	No fix yet
retail order broker oracle	`= 16.0= 18.0= 19.1`	No fix yet
retail order management system oracle	`= 19.5`	No fix yet
retail point-of-service oracle	`= 14.1`	No fix yet
retail predictive application server oracle	`= 14.1.3.46= 15.0.3.115= 16.0.3.240`	No fix yet
retail price management oracle	`= 13.2= 14.0.4= 14.1.3.0= 15.0.3.0= 16.0.3.0`	No fix yet
retail returns management oracle	`= 14.1`	No fix yet
retail service backbone oracle	`= 14.1.3= 14.1.3.2= 15.0.3.1= 19.0.0= 19.0.1= 19.0.1.0≥ 16.0.1, ≤ 16.0.3`	No fix yet
retail store inventory management oracle	`= 14.0.4.13= 14.1.3.14= 14.1.3.5= 15.0.3.3= 15.0.3.8= 16.0.3.7`	No fix yet
siebel ui framework oracle	`≤ 21.12`	No fix yet
sql developer oracle	`< 21.4.2`	`21.4.2`
taleo platform oracle	`< 22.1`	`22.1`
utilities framework oracle	`= 4.4.0.0.0= 4.4.0.2.0= 4.4.0.3.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	No fix yet
email security sonicwall	`≤ 10.0.12`	No fix yet
network security manager sonicwall	`≥ 2.0, < 3.0`	`3.0`
web application firewall sonicwall	`≥ 3.0.0, < 3.1.0`	`3.1.0`

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.

Affected packages

Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.

NVD description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

References

Mais vulnerabilidades de org.apache.logging.log4j:log4j-core

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free