What’s Vulnerable › Vulnerabilities

CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-05-01
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-14 · updated 2026-06-17
• Weakness: CWE-917

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Summary

CVE-2021-45046 is an incomplete fix for Log4j2's CVE-2021-44228, allowing attackers who control Thread Context Map (MDC) input to craft malicious JNDI lookups when a non-default Pattern Layout uses Context Lookup or %X/%mdc/%MDC patterns. This can lead to information leaks, remote code execution in some environments, and local code execution in all environments. Affected are Apache Log4j versions before 2.16.0 (Java 8) and 2.12.2 (Java 7), plus products bundling them such as Cvat, Debian Linux, Fedora, Intel Audio Development Kit, Intel Datacenter Manager, Intel Genomics Kernel Library, and Intel oneAPI Toolkit installers. The vulnerability is actively exploited (CISA KEV, SSVC active, EPSS 100%) and a public exploit exists. Apply updates to Log4j 2.16.0 or 2.12.2, or follow vendor instructions for affected products.

CVE-2021-45046 هو إصلاح غير مكتمل لثغرة CVE-2021-44228 في Log4j2، ويسمح للمهاجمين الذين يتحكمون في بيانات إدخال Thread Context Map (MDC) بتكوين استعلامات JNDI خبيثة عندما يستخدم تكوين التسجيل Pattern Layout غير افتراضي مع Context Lookup أو أنماط %X/%mdc/%MDC. قد يؤدي ذلك إلى تسريب معلومات وتنفيذ تعليمات برمجية عن بُعد في بعض البيئات وتنفيذ محلي في جميع البيئات. تتأثر إصدارات Apache Log4j قبل 2.16.0 (Java 8) و2.12.2 (Java 7)، بالإضافة إلى منتجات تتضمنها مثل Cvat وDebian Linux وFedora وIntel Audio Development Kit وIntel Datacenter Manager وIntel Genomics Kernel Library وبرامج تثبيت Intel oneAPI Toolkit. الثغرة مستغلة فعليًا (CISA KEV، SSVC active، EPSS 100%) ويوجد استغلال عام. طبّق التحديثات إلى Log4j 2.16.0 أو 2.12.2، أو اتبع تعليمات البائع للمنتجات المتأثرة.

Affected products

• Apache Log4j: from 2.0.1 before 2.12.2; from 2.13.0 before 2.16.0; 2.0, 2.0-beta9, 2.0-rc1, 2.0-rc2 — fixed in 2.12.2, 2.16.0
• Cvat Computer Vision Annotation Tool: all versions
• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 34, 35
• Intel Audio Development Kit: all versions
• Intel Datacenter Manager: all versions
• Intel Genomics Kernel Library: all versions
• Intel(R) oneAPI Toolkit and component software installers: all versions
• Intel Secure Device Onboard: all versions
• Intel Sensor Solution Firmware Development Kit: all versions
• Intel System Debugger: all versions
• Intel(R) System Studio: all versions
• Siemens 6Bk1602-0Aa12-0Tp0 Firmware: before 2.7.0 — fixed in 2.7.0
• Siemens 6Bk1602-0Aa22-0Tp0 Firmware: before 2.7.0 — fixed in 2.7.0
• Siemens 6Bk1602-0Aa32-0Tp0 Firmware: before 2.7.0 — fixed in 2.7.0
• Siemens 6Bk1602-0Aa42-0Tp0 Firmware: before 2.7.0 — fixed in 2.7.0
• Siemens 6Bk1602-0Aa52-0Tp0 Firmware: before 2.7.0 — fixed in 2.7.0
• Siemens Captial: before 2019.1; 2019.1, 2019.1-sp1912 — fixed in 2019.1
• Siemens COMOS: all versions
• Siemens Desigo Cc Advanced Reports: 4.0, 4.1, 4.2, 5.0, 5.1
• Siemens Desigo Cc Info Center: 5.0, 5.1
• Siemens E-Car Operation Center: before 2021-12-13 — fixed in 2021-12-13
• Siemens Energy Engage: 3.1
• Siemens Energyip: 8.5, 8.6, 8.7, 9.0
• Siemens Energyip Prepay: 3.7, 3.8
• Siemens GMA-Manager: before 8.6.2j-398 — fixed in 8.6.2j-398
• Siemens Head-End System Universal Device Integration System: all versions
• Siemens Industrial Edge Management: all versions
• Siemens Industrial Edge Management Hub: before 2021-12-13 — fixed in 2021-12-13
• Siemens LOGO! Soft Comfort: all versions

How to fix

Upgrade to a fixed version: Apache Log4j 2.12.2, 2.16.0; Siemens 6Bk1602-0Aa12-0Tp0 Firmware 2.7.0; Siemens 6Bk1602-0Aa22-0Tp0 Firmware 2.7.0; Siemens 6Bk1602-0Aa32-0Tp0 Firmware 2.7.0; Siemens 6Bk1602-0Aa42-0Tp0 Firmware 2.7.0; Siemens 6Bk1602-0Aa52-0Tp0 Firmware 2.7.0; Siemens Captial 2019.1; Siemens E-Car Operation Center 2021-12-13; Siemens GMA-Manager 8.6.2j-398; Siemens Industrial Edge Management Hub 2021-12-13; Siemens Mindsphere 2021-12-11; Siemens Navigator 2021-12-13. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/12/14/4
• http://www.openwall.com/lists/oss-security/2021/12/15/3
• http://www.openwall.com/lists/oss-security/2021/12/18/1
• https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/
• https://logging.apache.org/log4j/2.x/security.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• https://security.gentoo.org/glsa/202310-16

Get alerted when CVE-2021-45046 or the next vulnerability affects your stack