Apache · Log4j2
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
무엇인가
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
CISA: Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2023년 5월 22일
- CISA 목록에 추가됨
- 2023년 5월 1일
- 게시됨
- 2021년 12월 14일
- 심각도
- 치명적 9.0 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- >99.9% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-917
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(20)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://www.debian.org/security/2021/dsa-5022
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRB…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2…
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- https://www.cve.org/CVERecord?id=CVE-2021-44228
- http://www.openwall.com/lists/oss-security/2021/12/14/4
- https://logging.apache.org/log4j/2.x/security.html
- https://www.kb.cert.org/vuls/id/930724
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- http://www.openwall.com/lists/oss-security/2021/12/15/3
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- http://www.openwall.com/lists/oss-security/2021/12/18/1
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Apache의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2021. 12. 10. | Remote Code Execution | Log4j2 | 치명적 10.0 | >99.9% |
| 2026. 10. 8. | Command Injection | Struts | 높음 8.1 | 97% |
| 2026. 8. 4. | Missing Encryption of Sensitive Data | Tomcat | 높음 7.5 | 99% |
| 2026. 4. 16. | Improper Input Validation | ActiveMQ | 높음 8.8 | 98% |
| 2025. 5. 1. | Improper Escaping of Output | HTTP Server | 치명적 9.1 | >99.9% |
| 2025. 4. 1. | Path Equivalence | Tomcat | 치명적 10.0 | 99.9% |
| 2025. 2. 4. | Forced Browsing | OFBiz | 치명적 9.8 | >99.9% |
| 2024. 9. 18. | Improper Access Control | HugeGraph-Server | 치명적 9.8 | 99.2% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.