Apache Log4j up to 2.12.2/2.16.0 Lookup infinite loop

Summaryinfo

A vulnerability has been found in Apache Log4j up to 2.12.2/2.16.0 and classified as problematic. This issue affects some unknown processing of the component Lookup Handler. Performing a manipulation results in infinite loop. This vulnerability is cataloged as CVE-2021-45105. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Log4j up to 2.12.2/2.16.0. It has been classified as problematic. This affects an unknown part of the component Lookup Handler. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. The summary by CVE is:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

The weakness was shared 12/18/2021. The advisory is shared at logging.apache.org. This vulnerability is uniquely identified as CVE-2021-45105 since 12/16/2021. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The exploit is shared for download at logging.apache.org. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 276397 (TencentOS Server 3: log4j (TSSA-2022:0188)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.12.3 or 2.17.0 eliminates this vulnerability. The upgrade is hosted for download at logging.apache.org.

The vulnerability is also documented in the vulnerability database at Tenable (276397). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Apache

Name

• Log4j

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.12.0
• 2.12.1
• 2.12.2
• 2.13
• 2.14
• 2.15
• 2.16.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion