https://bugzilla.redhat.com/show_bug.cgi?id=2034067
Bug ID: 2034067
Summary: CVE-2021-45105 log4j-core: DoS in log4j 2.x with
Thread Context Map (MDC) input data contains a
recursive lookup and context lookup pattern
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, ahenning(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bdettelb(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
clement.escoffier(a)redhat.com, crarobin(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dbhole(a)redhat.com, devrim(a)gunduz.org,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ewolinet(a)redhat.com,
fjuma(a)redhat.com, gsmet(a)redhat.com,
hamadhan(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jmadigan(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jrokos(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kaycoth(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lthon(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, ngough(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pamccart(a)redhat.com, paul.wouters(a)aiven.io,
peholase(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
probinso(a)redhat.com, pskopek(a)redhat.com,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, sbiarozk(a)redhat.com,
sd-operator-metering(a)redhat.com, sdouglas(a)redhat.com,
sguilhen(a)redhat.com, smaestri(a)redhat.com,
sponnaga(a)redhat.com, tflannag(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
vkumar(a)redhat.com, yborgess(a)redhat.com
Blocks: 2030930
Target Milestone: ---
Classification: Other
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from
uncontrolled recursion from self-referential lookups. When the logging
configuration uses a non-default Pattern Layout with a Context Lookup (for
example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC)
input data can craft malicious input data that contains a recursive lookup,
resulting in a StackOverflowError that will terminate the process. This is also
known as a DOS (Denial of Service) attack.
This issue is being tracked as LOG4J2-3230
Mitigation:
Implement one of the following mitigation techniques:
* Java 8 (or later) users should upgrade to release 2.17.0.
Alternatively, this can be mitigated in configuration:
* In PatternLayout in the logging configuration, replace Context Lookups like
${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc,
or %MDC).
* Otherwise, in the configuration, remove references to Context Lookups like
${ctx:loginId} or $${ctx:loginId} where they originate from sources external to
the application such as HTTP headers or user input.
Note that only the log4j-core JAR file is impacted by this vulnerability.
Applications using only the log4j-api JAR file without the log4j-core JAR file
are not impacted by this vulnerability.
Reference:
https://logging.apache.org/log4j/2.x/security.html
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://issues.apache.org/jira/browse/LOG4J2-3230
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2034067