https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Bug ID: 2032580 Summary: CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, asoldano@redhat.com, atangrin@redhat.com, ataylor@redhat.com, avibelli@redhat.com, bbaranow@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bdettelb@redhat.com, bgeorges@redhat.com, bibryam@redhat.com, bkearney@redhat.com, bmaxwell@redhat.com, bmontgom@redhat.com, boliveir@redhat.com, brian.stansberry@redhat.com, btotty@redhat.com, caswilli@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, clement.escoffier@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dbecker@redhat.com, dbhole@redhat.com, devrim@gunduz.org, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, ehelms@redhat.com, eleandro@redhat.com, eparis@redhat.com, etirelli@redhat.com, ewolinet@redhat.com, fjuma@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gsmet@redhat.com, hamadhan@redhat.com, hbraun@redhat.com, hhorak@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jcantril@redhat.com, jjoyce@redhat.com, jnethert@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jorton@redhat.com, jpallich@redhat.com, jperkins@redhat.com, jrokos@redhat.com, jross@redhat.com, jschluet@redhat.com, jsherril@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, lgao@redhat.com, lhh@redhat.com, lpeer@redhat.com, lthon@redhat.com, lzap@redhat.com, mburns@redhat.com, mhulan@redhat.com, mizdebsk@redhat.com, mkolesni@redhat.com, mmccune@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msvehla@redhat.com, mszynkie@redhat.com, myarboro@redhat.com, nmoumoul@redhat.com, nstielau@redhat.com, nwallace@redhat.com, orabin@redhat.com, pantinor@redhat.com, paul.wouters@aiven.io, pcreech@redhat.com, pdelbell@redhat.com, pdrozd@redhat.com, peholase@redhat.com, pgallagh@redhat.com, pjindal@redhat.com, pmackay@redhat.com, probinso@redhat.com, rchan@redhat.com, rguimara@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, sbiarozk@redhat.com, sclewis@redhat.com, scohen@redhat.com, sd-operator-metering@redhat.com, sdouglas@redhat.com, slinaber@redhat.com, smaestri@redhat.com, sponnaga@redhat.com, sthorger@redhat.com, swoodman@redhat.com, tbrisker@redhat.com, tflannag@redhat.com, tom.jenkinson@redhat.com, tzimanyi@redhat.com, vkumar@redhat.com, yborgess@redhat.com Target Milestone: --- Classification: Other
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT mitigate this specific vulnerability.
Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Reference: https://www.openwall.com/lists/oss-security/2021/12/14/4
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032581
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2032581 [Bug 2032581] CVE-2021-45046 log4j: log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created log4j tracking bugs for this issue:
Affects: fedora-all [bug 2032581]
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2030930
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core: |thread context message |thread context message |pattern and context lookup |pattern and context lookup |pattern vulnerable to DoS |pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #2 from Przemyslaw Roguski proguski@redhat.com --- upstream advisory: https://logging.apache.org/log4j/2.x/security.html
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core: |thread context message |DoS in log4j 2.x with |pattern and context lookup |thread context message |pattern vulnerable to DoS |pattern and context lookup | |pattern
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core: |DoS in log4j 2.x with |DoS in log4j 2.x with |thread context message |thread context message |pattern and context lookup |pattern and context lookup |pattern |pattern (incomplete fix for | |CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Florencio Cano fcanogab@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032754
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |log4j 2.16.0
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Doc Text *updated* by Paramvir jindal pjindal@redhat.com --- A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in a denial of service (DOS) attack.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2030986
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2031028
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.8
Via RHSA-2021:5148 https://access.redhat.com/errata/RHSA-2021:5148
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5148
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5106 https://access.redhat.com/errata/RHSA-2021:5106
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5106
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5141 https://access.redhat.com/errata/RHSA-2021:5141
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5141
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.7
Via RHSA-2021:5107 https://access.redhat.com/errata/RHSA-2021:5107
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5107
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #10 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-45046
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |ERRATA Status|NEW |CLOSED Last Closed| |2021-12-16 16:56:56
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #12 from Yadnyawalk Tale ytale@redhat.com --- Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Jonathan Christison jochrist@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Severity|low |medium Priority|low |medium
--- Doc Text *updated* --- A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
yuk fadamo@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |fadamo@gmail.com
--- Comment #13 from yuk fadamo@gmail.com --- And what about the fix for Red Hat JBoss Enterprise Application Platform 7 marked as affected?
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2034754
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2030985
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |security-response-team@redh | |at.com Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) |needinfo?(ytale@redhat.com) CC| |ytale@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yadnyawalk Tale ytale@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ytale@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Mithilesh Kaur Bagga mbagga@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mbagga@redhat.com Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580 Bug 2032580 depends on bug 2032581, which changed state.
Bug 2032581 Summary: CVE-2021-45046 log4j: log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2032581
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) |needinfo?(hvyas@redhat.com) CC| |hvyas@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Hardik Vyas hvyas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(hvyas@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.8.2 7.9.1 7.10.1
Via RHSA-2022:0203 https://access.redhat.com/errata/RHSA-2022:0203
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0203
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 8.2.3
Via RHSA-2022:0205 https://access.redhat.com/errata/RHSA-2022:0205
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0205
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Vert.x 4.1.8
Via RHSA-2022:0083 https://access.redhat.com/errata/RHSA-2022:0083
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0083
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.4 log4j async
Via RHSA-2022:0216 https://access.redhat.com/errata/RHSA-2022:0216
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0216
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Integration Camel Extensions for Quarkus 2.2
Via RHSA-2022:0222 https://access.redhat.com/errata/RHSA-2022:0222
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0222
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Integration Camel-K 1.6.3
Via RHSA-2022:0223 https://access.redhat.com/errata/RHSA-2022:0223
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0223
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2022:1296 https://access.redhat.com/errata/RHSA-2022:1296
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1296
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2022:1297 https://access.redhat.com/errata/RHSA-2022:1297
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1297
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.4.4 release
Via RHSA-2022:1299 https://access.redhat.com/errata/RHSA-2022:1299
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1299
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Via RHSA-2025:1746 https://access.redhat.com/errata/RHSA-2025:1746
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2025:1746
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
Via RHSA-2025:1747 https://access.redhat.com/errata/RHSA-2025:1747
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2025:1747
java-sig-commits@lists.fedoraproject.org