Read the docs
TI-2021-20393 Aliases CVE-2021-45046GHSA-7rjr-3q55-vv33

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Priority CRITICAL 98Exploited in the wildCWE-917Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 19 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-917.

Summary

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Why it matters now

Exploitation Active In CISA KEV since 2023-05-01CISA due date 2023-05-22Known ransomware use
EPSS 0.99977 99th percentileScored 2026-11-07
Fix Partial Apache Log4j (Apache Software Foundation): 2.16.0org.apache.logging.log4j:log4j-core (Maven): 2.16.0, 2.12.2, 2.3.1+1 more productRed Hat: 23 advisoriesRed Hat: 19 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4jApache Log4j2 to before 2.16.02.16.0Patch availableCNA
—org.apache.logging.log4j:log4j-core (Maven)2.13.0 to before 2.16.02.16.0Patch availableGHSA-7rjr-3q55-vv33
—org.apache.logging.log4j:log4j-core (Maven)2.4.0 to before 2.12.22.12.2Patch availableGHSA-7rjr-3q55-vv33
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.8.0 to before 1.9.21.9.2Patch availableGHSA-7rjr-3q55-vv33
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.10.0 to before 1.10.81.10.8Patch availableGHSA-7rjr-3q55-vv33
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.11.0 to before 1.11.111.11.11Patch availableGHSA-7rjr-3q55-vv33
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)2.0.0 to before 2.0.122.0.12Patch availableGHSA-7rjr-3q55-vv33
—org.apache.logging.log4j:log4j-core (Maven)before 2.3.12.3.1Patch availableGHSA-7rjr-3q55-vv33
  • Apache Log4j VendorApache Affected Apache Log4j2 to before 2.16.0 Fixed in 2.16.0 Patch available CNA
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.13.0 to before 2.16.0 Fixed in 2.16.0 Patch available GHSA-7rjr-3q55-vv33
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.4.0 to before 2.12.2 Fixed in 2.12.2 Patch available GHSA-7rjr-3q55-vv33
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.8.0 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-7rjr-3q55-vv33
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.10.0 to before 1.10.8 Fixed in 1.10.8 Patch available GHSA-7rjr-3q55-vv33
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.11.0 to before 1.11.11 Fixed in 1.11.11 Patch available GHSA-7rjr-3q55-vv33
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 2.0.0 to before 2.0.12 Fixed in 2.0.12 Patch available GHSA-7rjr-3q55-vv33
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected before 2.3.1 Fixed in 2.3.1 Patch available GHSA-7rjr-3q55-vv33

CPE configurations NVD · 95

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.0.1 to before 2.12.2; 2.13.0 to before 2.16.0VulnerableApache
cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*2.0 beta9VulnerableApache
cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*2.0 rc1VulnerableApache
cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*2.0 rc2VulnerableApache
cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:*not specified by NVDVulnerablecvat-ai
cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:*not specified by NVDVulnerableIntel
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 2.0.1 to before 2.12.2; 2.13.0 to before 2.16.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* Versions 2.0 beta9 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* Versions 2.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* Versions 2.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·cvat-ai
  • cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:* Versions not specified by NVD Vulnerable ·Intel
Show 85 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*before 2019.1VulnerableSiemens
cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*2019.1VulnerableSiemens
cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*2019.1 sp1912VulnerableSiemens
cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*4.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*4.1VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*5.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*5.1VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*5.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*5.1VulnerableSiemens
cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*before 2021-12-13VulnerableSiemens
cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*3.1VulnerableSiemens
cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*8.5VulnerableSiemens
cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*8.6VulnerableSiemens
cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*8.7VulnerableSiemens
cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*3.7VulnerableSiemens
cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*3.8VulnerableSiemens
cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*before 8.6.2j-398VulnerableSiemens
cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*before 2021-12-13VulnerableSiemens
cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*before 2021-12-11VulnerableSiemens
cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*before 2021-12-13VulnerableSiemens
cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*up to 3.2VulnerableSiemens
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*up to 1.1.3VulnerableSiemens
cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*4.1VulnerableSiemens
cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*4.3VulnerableSiemens
cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*4.4VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*2.80VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*2.85VulnerableSiemens
cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*up to 4.16.2.1VulnerableSiemens
cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*1.5VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*1.6VulnerableSiemens
cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*before 2020VulnerableSiemens
cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*2020VulnerableSiemens
cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*2020VulnerableSiemens
cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*2020 sp2002VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*before 4.70VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*4.70VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*4.70 sp7VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*4.70 sp8VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*before 2.30VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*2.30VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*2.30VulnerableSiemens
cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*2.30 sp2VulnerableSiemens
cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*before 2019.1VulnerableSiemens
cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*2019.1VulnerableSiemens
cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*2019.1VulnerableSiemens
cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*2019.1 sp1912VulnerableSiemens
cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*before 10.0.12VulnerableSonicWall
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableSiemens
cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableSiemens
cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableSiemens
cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableSiemens
cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableSiemens
  • cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:* Versions before 2019.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:* Versions 2019.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:* Versions 2019.1 sp1912 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* Versions before 2021-12-13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:* Versions 8.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:* Versions 8.7 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* Versions 3.7 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* Versions before 8.6.2j-398 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* Versions before 2021-12-13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* Versions before 2021-12-11 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* Versions before 2021-12-13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* Versions up to 3.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* Versions up to 1.1.3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* Versions 2.80 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* Versions 2.85 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* Versions up to 4.16.2.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:* Versions before 2020 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:* Versions 2020 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:* Versions 2020 sp2002 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* Versions before 4.70 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* Versions 4.70 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* Versions 4.70 sp7 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* Versions 4.70 sp8 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:* Versions before 2.30 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:* Versions 2.30 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:* Versions 2.30 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:* Versions 2.30 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:* Versions before 2019.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:* Versions 2019.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:* Versions 2019.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:* Versions 2019.1 sp1912 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:* Versions before 10.0.12 Vulnerable ·SonicWall
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Siemens

Remediation

  • Fix · CNA Apache Log4j (Apache Software Foundation) Fixed in 2.16.0
  • Fix · GHSA-7rjr-3q55-vv33 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.16.0 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.12.2 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.9.2 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.10.8 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.11.11 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 2.0.12 Advisory →
  • Fix · GHSA-7rjr-3q55-vv33 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.3.1 Advisory →

Red Hat 23 advisories

  • RHSA-2025:1747 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.12 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
  • RHSA-2025:1746 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
  • RHSA-2022:1299 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar, org.jboss.logmanager.log4j-jboss-logmanager-1.2.2.Final-redhat-00002.jar
Show 20 more Red Hat advisories
  • RHSA-2022:1297 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j-2.17.1-1.redhat_00001.1.el8eap
  • RHSA-2022:1296 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j-2.17.1-1.redhat_00001.1.el7eap
  • RHSA-2022:0223 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.6.3 release and security update
    • Red Hat Integration Camel-K 1.6.3
  • RHSA-2022:0222 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2 security update
    • Red Hat Integration Camel Extensions for Quarkus 2.2
  • RHSA-2022:0216 Released 2022-01-20 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar
  • RHSA-2022:0083 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.8 security update
    • Vert.x 4.1.8
  • RHSA-2022:0205 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Data Grid 8.2.3 security update
    • Red Hat Data Grid 8.2.3
  • RHSA-2022:0203 Released 2022-01-20 · Red Hat rating Critical
    Red Hat Fuse 7.8-7.10 security update
    • Red Hat Fuse 7.8.2, 7.9.1, 7.10.1
  • RHSA-2022:0138 Released 2022-01-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.0.0 release and security update
    • Red Hat AMQ Streams 2.0.0
  • RHSA-2021:5107 Released 2021-12-16 · Red Hat rating Critical
    OpenShift Container Platform 4.7.40 security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hadoop, openshift4/ose-metering-hive, openshift4/ose-metering-presto
  • RHSA-2021:5141 Released 2021-12-16 · Red Hat rating Critical
    OpenShift Container Platform 4.6.52 security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
  • RHSA-2021:5106 Released 2021-12-16 · Red Hat rating Critical
    OpenShift Container Platform 4.6.z security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6, openshift4/ose-metering-hive
  • RHSA-2021:5148 Released 2021-12-15 · Red Hat rating Critical
    OpenShift Container Platform 4.8.24 extras security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
  • RHSA-2021:5140 Released 2021-12-15 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00002.jar
  • RHSA-2021:5137 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging Security Release (5.0.10)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5129 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.3.1)
    • OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5127 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.2.4)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5128 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.1.5)
    • OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5108 Released 2021-12-14 · Red Hat rating Critical
    OpenShift Container Platform 4.8.z security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive
  • RHSA-2021:5094 Released 2021-12-14 · Red Hat rating Moderate
    OpenShift Container Platform 3.11.z security update
    • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
streams for Apache KafkaAffectedNo fix yet
OpenShift Logging 5.0Fixed RHSA-2021:5137
OpenShift Logging 5.1Fixed RHSA-2021:5128
OpenShift Logging 5.2Fixed RHSA-2021:5127
OpenShift Logging 5.3Fixed RHSA-2021:5129
Red Hat AMQ Streams 2.0.0Fixed RHSA-2022:0138
Red Hat Data Grid 8.2.3Fixed RHSA-2022:0205
Red Hat Fuse 7.8.2, 7.9.1, 7.10.1Fixed RHSA-2022:0203
Red Hat Integration Camel Extensions for Quarkus 2.2Fixed RHSA-2022:0222
Red Hat Integration Camel-K 1.6.3Fixed RHSA-2022:0223
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:1296
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:1297
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:5140, RHSA-2022:0216
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:1747
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:5094
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:5106, RHSA-2021:5141
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:5107
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:5108, RHSA-2021:5148
Vert.x 4.1.8Fixed RHSA-2022:0083
Not affected: 24 products
  • A-MQ Clients 2
  • OpenShift Logging 5.0
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3
  • Red Hat AMQ Broker 7
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections
  • Red Hat build of Quarkus

Timeline

  1. 2023-05-01 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-45046
  3. 2026-10-03 Alias added: GHSA-7rjr-3q55-vv33

References

Patch 1

Advisory 20

Other 10

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
  • TI-2021-20283 Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration CVSS 3.1MEDIUM 6.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences