Veille CVE
CVE-2021-45046
9.0 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Ajoutée le 01/05/2023 · Échéance de correction (agences US) : 22/05/2023
Action requise : Apply updates per vendor instructions.
Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Produits concernés
- Apache Software Foundation Apache Log4j
- Apache log4j
- Cvat computer vision annotation tool
- Intel audio development kit
- Intel datacenter manager
- Intel genomics kernel library
- Intel oneapi
- Intel secure device onboard
- Intel sensor solution firmware development kit
- Intel system debugger
- Intel system studio
- Siemens sppa-t3000 ses3000 firmware
- Siemens captial
- Siemens comos
- Siemens desigo cc advanced reports
- Siemens desigo cc info center
- Siemens e-car operation center
- Siemens energy engage
- Siemens energyip
- Siemens energyip prepay
- Siemens gma-manager
- Siemens head-end system universal device integration system
- Siemens industrial edge management
- Siemens industrial edge management hub
- Siemens logo\! soft comfort
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.0 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | 9.0 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 2.0 | 5.1 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing ListMitigationThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/18/1 Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ Mailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ Mailing ListRelease Notes
- https://logging.apache.org/log4j/2.x/security.html MitigationRelease NotesVendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
- https://security.gentoo.org/glsa/202310-16 Third Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44228 Not Applicable
- https://www.debian.org/security/2021/dsa-5022 Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
- https://www.kb.cert.org/vuls/id/930724 Third Party AdvisoryUS Government Resource
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing ListMitigationThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/18/1 Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ Mailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ Mailing ListRelease Notes
- https://logging.apache.org/log4j/2.x/security.html MitigationRelease NotesVendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
- https://security.gentoo.org/glsa/202310-16 Third Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44228 Not Applicable
- https://www.debian.org/security/2021/dsa-5022 Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
- https://www.kb.cert.org/vuls/id/930724 Third Party AdvisoryUS Government Resource
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046 US Government Resource