Details of VAR-202112-0562

ID

VAR-202112-0562

CVE

CVE-2021-45046

TITLE

Apache Log4j allows insecure JNDI lookups

Trust: 0.8

sources: CERT/CC: VU#930724

DESCRIPTION

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default. Apache Log4j allows insecure JNDI lookups that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the vulnerable Java application using Log4j.CVE-2021-4104 Affected CVE-2021-44228 Affected CVE-2021-45046 AffectedCVE-2021-4104 Affected CVE-2021-44228 Affected CVE-2021-45046 Affected. For the oldstable distribution (buster), this problem has been fixed in version 2.16.0-1~deb10u1. For the stable distribution (bullseye), this problem has been fixed in version 2.16.0-1~deb11u1. We recommend that you upgrade your apache-log4j2 packages. For the detailed security status of apache-log4j2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/apache-log4j2 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmG7FI5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeSqOg//XOye7T/8PKOrrUtHFhH+w2dOC0GujwcIS2mhofVuZQTPYvM5uTZxDTuz rQN+T505t9QaP3sF05gXK6VI675HhgmF3d+vDEnhp8QpZX5HeJrmmX44FewZQAqP yMysAuwG1RJ0Qgs7NmppU/XJBnmhJLsqsW99kcDnNXS67D23e1nUqAEDME5baSoF VPc50Up/yh4DE28Jcs8Mh2cM8UqmeLEQJ8XC3IojQLhmOF1UBJuL4K0sEUqWtJeN TytHya2XdfIIZcRolHe6AUeiLP5JpitbqkVP+hEeruAvk8nTGsLi0HMbWxA9LLcB bB9KKJjf6xndRa/t/IXGMzwr883t5/YLdxbCFcGj9M4Bfj7SAhGdgnJHZaRt1quX Vcqnu1pDHpdFuRX4t6oqF9R0uiBGeupZmGdb1y7os+FU2EbTRYU0rlnhfOsou0ex Vh5sFKFDhgWUQoyuVUMh6eOZ7p92GTzbw5kPkvboa7Xdrs02m7ChLlh8f5ajRFrK WbAcwsBj6RK4dmtdvfO2sVEuRTpFQ3qtecwZUR0pqUIjJ+rfurSGmpPr3iOrBu2s ROol/vLfW5uZd6RxSNbt3twPcwBaZagFQCcDY27Yz0sH6DlQUmWed1KJjbRaZ7fn cqjFisSZxu8d5VoAtjMSP8l95FoAm53r9Q1HCZvXqRhBjFNoYqE= =TNnt -----END PGP SIGNATURE----- . Solution: For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Data Grid 8.2.3 security update Advisory ID: RHSA-2022:0205-01 Product: Red Hat JBoss Data Grid Advisory URL: https://access.redhat.com/errata/RHSA-2022:0205 Issue date: 2022-01-20 CVE Names: CVE-2021-44832 CVE-2021-45046 CVE-2021-45105 ===================================================================== 1. Summary: An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.2.3 replaces Data Grid 8.2.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.2.3 in the Release Notes [3]. 3. Solution: To install this update, do the following: 1. Download the Data Grid 8.2.3 server patch from the customer portal[²]. 2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. 3. Install the Data Grid 8.2.3 server patch. Refer to the 8.2.3 Release Notes[³] for patching instructions. 4. Restart Data Grid to ensure the changes take effect. 4. References: https://access.redhat.com/security/cve/CVE-2021-44832 https://access.redhat.com/security/cve/CVE-2021-45046 https://access.redhat.com/security/cve/CVE-2021-45105 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=data.grid&version=8.2 https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYemZbtzjgjWX9erEAQgkThAAhlH9r6fZ08ZbIvy7t5FNceA93qd12PsL bJEZ9axgCc1hrxm5hK2W6x55a2tKQ0ieoFlkF87qZ5FSsEmOWfvCa5Jsr04bGkhI QBiyZvX+de8ZAUcbiXwgsb3LwfY5DAOoLZVZj7tWsxXcl9CG/MGqI452b5jB4oWa 5TXa8YHSz9/vQHtJGmjyuZYJGfH63XvLUu6qHEgCHKhXEQg5p9YrfjbdZWk77mSk N+dqHpXJFo2G+UURxBy615ebIgxA1dUR6pdbCfm/fbUAxnxWPubjNLLGShCUNBP9 /WgSMiv5GT48yhpK0IdTpPmQUAQW3fkgEd58vytgDuQf/7NhsbNFlsj3hugnAmY9 B/Jtwri/dCaOy0EDlDTc22OX7uDXaoSd9t5kjFAiZMOhxRE0hXawGfCxdGq/rgV6 EblcKQ3zW/3lsTj5KdI+0M0kNA6y1i0KP+Iujs12WLzWDANcpyvpuNu5qIMoM16Y iy4QLJkWFcH99toKO6/bEFgINq3C84sDEQNUpgwga+ct5mxsZycn3vSl9QcuoWQD FX9lwXBaxGuvBb/K3pwXfJuRQOFn2tDpwqN0PnyG/4+QLHunSPuQ8vcVx+oG9a2K LpiYxMQawsJiOjEyNUdRt7DDBpU/mVO+pf7lCY/4F5S+xOJ6E6LkJ213aSGaYPBd QiLGYFSmmLk= =y5SE -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . The purpose of this text-only errata is to inform you about the security issues fixed. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.3 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.4 Release Notes for information about the most significant bug fixes and enhancements included in this release. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). JIRA issues fixed (https://issues.jboss.org/): JBEAP-22105 - (7.4.z) Upgrade from com.io7m.xom:xom 1.2.10 to xom:xom 1.3.7 JBEAP-22385 - (7.4.z) Upgrade ASM from 7.1 to 9.1 JBEAP-22731 - (7.4.z) Upgrade Artemis from 2.16.0.redhat-00032 to 2.16.0.redhat-00034 JBEAP-22738 - (7.4.z) Upgrade jbossws-cxf from 5.4.2.Final to 5.4.4.Final(Fix UsernameTokenElytronTestCase on SE 17) JBEAP-22819 - [GSS] (7.4.z) HAL-1762 - Aliases are removed from the credential store when passwords are updated from the admin console JBEAP-22839 - [GSS](7.4.z) Upgrade yasson from 1.0.9.redhat-00001 to 1.0.10.redhat-00001 JBEAP-22864 - (7.4.z) Upgrade HAL from 3.3.8.Final-redhat-00001 to 3.3.9.Final-redhat-00001 JBEAP-22904 - (7.4.z) Upgrade Hibernate ORM from 5.3.24.Final-redhat-00001 to 5.3.25.Final-redhat-00002 JBEAP-22911 - (7.4.z) Upgrade OpenSSL from 2.1.3.Final-redhat-00001 to 2.2.0.Final-redhat-00001 JBEAP-22912 - (7.4.z) Upgrade OpenSSL Natives from 2.1.0.SP01-redhat-00001 to 2.2.0.Final-redhat-00001 JBEAP-22913 - (7.4.z) Upgrade WildFly Core from 15.0.6.Final-redhat-00003 to 15.0.7.Final-redhat-00001 JBEAP-22935 - (7.4.z) Upgrade jboss-vfs from 3.2.15.Final-redhat-00001 to 3.2.16.Final-redhat-00001 JBEAP-22945 - (7.4.z) Upgrade org.apache.logging.log4j from 2.14.0.redhat-00002 to 2.17.1.redhat-00001 JBEAP-22973 - (7.4.z) Upgrade Elytron from 1.15.9.Final-redhat-00001 to 1.15.11.Final-redhat-00002 JBEAP-23038 - (7.4.z) Upgrade galleon-plugins from 5.1.4.Final to 5.2.6.Final JBEAP-23040 - (7.4.z) Upgrade galleon-plugins in wildfly-core-eap from 5.1.4.Final to 5.2.6.Final JBEAP-23045 - (7.4.z) Upgrade Undertow from 2.2.13.SP2-redhat-00001 to 2.2.16.Final-redhat-0001 JBEAP-23101 - (7.4.z) Upgrade Infinispan from 11.0.12.Final to 11.0.15.Final JBEAP-23105 - (7.4.z) Upgrade Narayana from 5.11.3.Final-redhat-00001 to 5.11.4.Final-redhat-00001 JBEAP-23143 - (7.4.z) Upgrade from org.eclipse.jdt.core.compiler:ecj:4.6.1 to org.eclipse.jdt:ecj:3.26 JBEAP-23177 - (7.4.z) Upgrade XNIO from 3.8.5.SP1-redhat-00001 to 3.8.6.Final-redhat-00001 JBEAP-23323 - [GSS](7.4.z) WFLY-16112 - Batch JobOperatorService should look for only active job names to stop during suspend JBEAP-23373 - (7.4.z) Upgrade OpenSSL from 2.2.0.Final-redhat-00001 to 2.2.0.Final-redhat-00002 JBEAP-23374 - (7.4.z) Upgrade WildFly Core from 15.0.7.Final-redhat-00001 to 15.0.8.Final-redhat-00001 JBEAP-23375 - (7.4.z) Upgrade OpenSSL Natives from 2.2.0.Final-redhat-00001 to 2.2.0.Final-redhat-00002 6

Trust: 2.43

sources: NVD: CVE-2021-45046 // CERT/CC: VU#930724 // VULMON: CVE-2021-45046 // PACKETSTORM: 169180 // PACKETSTORM: 165326 // PACKETSTORM: 165333 // PACKETSTORM: 165343 // PACKETSTORM: 165636 // PACKETSTORM: 165645 // PACKETSTORM: 165649 // PACKETSTORM: 166673

AFFECTED PRODUCTS

vendor:	siemens	model:	energyip prepay	scope:	eq	version:	3.8	Trust: 1.0
vendor:	siemens	model:	solid edge harness design	scope:	lt	version:	2020	Trust: 1.0
vendor:	siemens	model:	6bk1602-0aa12-0tp0	scope:	lt	version:	2.7.0	Trust: 1.0
vendor:	siemens	model:	logo\! soft comfort	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	siveillance vantage	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	vesys	scope:	eq	version:	2019.1	Trust: 1.0
vendor:	siemens	model:	sentron powermanager	scope:	eq	version:	4.1	Trust: 1.0
vendor:	siemens	model:	siguard dsa	scope:	eq	version:	4.2	Trust: 1.0
vendor:	siemens	model:	siguard dsa	scope:	eq	version:	4.4	Trust: 1.0
vendor:	intel	model:	audio development kit	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	xpedition enterprise	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	comos	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	desigo cc advanced reports	scope:	eq	version:	4.0	Trust: 1.0
vendor:	apache	model:	log4j	scope:	gte	version:	2.0.1	Trust: 1.0
vendor:	siemens	model:	siveillance control pro	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	tracealertserverplus	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	spectrum power 4	scope:	lt	version:	4.70	Trust: 1.0
vendor:	siemens	model:	desigo cc advanced reports	scope:	eq	version:	4.1	Trust: 1.0
vendor:	siemens	model:	desigo cc info center	scope:	eq	version:	5.1	Trust: 1.0
vendor:	siemens	model:	nx	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	6bk1602-0aa52-0tp0	scope:	lt	version:	2.7.0	Trust: 1.0
vendor:	siemens	model:	energyip	scope:	eq	version:	9.0	Trust: 1.0
vendor:	siemens	model:	desigo cc advanced reports	scope:	eq	version:	4.2	Trust: 1.0
vendor:	siemens	model:	energyip	scope:	eq	version:	8.7	Trust: 1.0
vendor:	siemens	model:	opcenter intelligence	scope:	lte	version:	3.2	Trust: 1.0
vendor:	siemens	model:	siveillance identity	scope:	eq	version:	1.6	Trust: 1.0
vendor:	sonicwall	model:	email security	scope:	lt	version:	10.0.12	Trust: 1.0
vendor:	intel	model:	secure device onboard	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	industrial edge management hub	scope:	lt	version:	2021-12-13	Trust: 1.0
vendor:	siemens	model:	desigo cc advanced reports	scope:	eq	version:	5.0	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	34	Trust: 1.0
vendor:	debian	model:	linux	scope:	eq	version:	11.0	Trust: 1.0
vendor:	siemens	model:	energyip prepay	scope:	eq	version:	3.7	Trust: 1.0
vendor:	siemens	model:	energyip	scope:	eq	version:	8.6	Trust: 1.0
vendor:	intel	model:	system studio	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	siguard dsa	scope:	eq	version:	4.3	Trust: 1.0
vendor:	apache	model:	log4j	scope:	lt	version:	2.12.2	Trust: 1.0
vendor:	siemens	model:	siveillance identity	scope:	eq	version:	1.5	Trust: 1.0
vendor:	siemens	model:	solid edge cam pro	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	spectrum power 4	scope:	eq	version:	4.70	Trust: 1.0
vendor:	siemens	model:	desigo cc info center	scope:	eq	version:	5.0	Trust: 1.0
vendor:	siemens	model:	spectrum power 7	scope:	eq	version:	2.30	Trust: 1.0
vendor:	siemens	model:	industrial edge management	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	captial	scope:	lt	version:	2019.1	Trust: 1.0
vendor:	siemens	model:	desigo cc advanced reports	scope:	eq	version:	5.1	Trust: 1.0
vendor:	siemens	model:	gma-manager	scope:	lt	version:	8.6.2j-398	Trust: 1.0
vendor:	intel	model:	oneapi	scope:	eq	version:	-	Trust: 1.0
vendor:	cvat	model:	computer vision annotation tool	scope:	eq	version:	-	Trust: 1.0
vendor:	debian	model:	linux	scope:	eq	version:	10.0	Trust: 1.0
vendor:	siemens	model:	mendix	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	sentron powermanager	scope:	eq	version:	4.2	Trust: 1.0
vendor:	siemens	model:	6bk1602-0aa22-0tp0	scope:	lt	version:	2.7.0	Trust: 1.0
vendor:	siemens	model:	energy engage	scope:	eq	version:	3.1	Trust: 1.0
vendor:	siemens	model:	operation scheduler	scope:	lte	version:	1.1.3	Trust: 1.0
vendor:	siemens	model:	sppa-t3000 ses3000	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	navigator	scope:	lt	version:	2021-12-13	Trust: 1.0
vendor:	apache	model:	log4j	scope:	lt	version:	2.16.0	Trust: 1.0
vendor:	siemens	model:	siveillance viewpoint	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	spectrum power 7	scope:	lt	version:	2.30	Trust: 1.0
vendor:	siemens	model:	xpedition package integrator	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	solid edge harness design	scope:	eq	version:	2020	Trust: 1.0
vendor:	intel	model:	sensor solution development kit	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	captial	scope:	eq	version:	2019.1	Trust: 1.0
vendor:	siemens	model:	siveillance command	scope:	lte	version:	4.16.2.1	Trust: 1.0
vendor:	apache	model:	log4j	scope:	gte	version:	2.13.0	Trust: 1.0
vendor:	siemens	model:	vesys	scope:	lt	version:	2019.1	Trust: 1.0
vendor:	intel	model:	system debugger	scope:	eq	version:	-	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	35	Trust: 1.0
vendor:	siemens	model:	6bk1602-0aa32-0tp0	scope:	lt	version:	2.7.0	Trust: 1.0
vendor:	siemens	model:	teamcenter	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	datacenter manager	scope:	eq	version:	-	Trust: 1.0
vendor:	siemens	model:	head-end system universal device integration system	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	mindsphere	scope:	lt	version:	2021-12-11	Trust: 1.0
vendor:	siemens	model:	sipass integrated	scope:	eq	version:	2.85	Trust: 1.0
vendor:	apache	model:	log4j	scope:	eq	version:	2.0	Trust: 1.0
vendor:	siemens	model:	energyip	scope:	eq	version:	8.5	Trust: 1.0
vendor:	siemens	model:	sipass integrated	scope:	eq	version:	2.80	Trust: 1.0
vendor:	siemens	model:	e-car operation center	scope:	lt	version:	2021-12-13	Trust: 1.0
vendor:	siemens	model:	6bk1602-0aa42-0tp0	scope:	lt	version:	2.7.0	Trust: 1.0
vendor:	intel	model:	genomics kernel library	scope:	eq	version:	-	Trust: 1.0

sources: NVD: CVE-2021-45046

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-45046
value:	CRITICAL
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2021-45046
value:	CRITICAL
Trust: 1.0
VULMON:	CVE-2021-45046
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-45046
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1

nvd@nist.gov:	CVE-2021-45046
baseSeverity:	CRITICAL
baseScore:	9.0
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	6.0
version:	3.1
Trust: 2.0

sources: VULMON: CVE-2021-45046 // NVD: CVE-2021-45046 // NVD: CVE-2021-45046

PROBLEMTYPE DATA

problemtype:

CWE-917

Trust: 1.0

sources: NVD: CVE-2021-45046

THREAT TYPE

remote

Trust: 0.1

sources: PACKETSTORM: 166673

TYPE

code execution

Trust: 0.6

sources: PACKETSTORM: 165326 // PACKETSTORM: 165333 // PACKETSTORM: 165343 // PACKETSTORM: 165636 // PACKETSTORM: 165645 // PACKETSTORM: 165649

PATCH

title:	Debian CVElist Bug Report Logs: apache-log4j2: CVE-2021-45046: Incomplete fix for CVE-2021-44228 in certain non-default configurations	url:	https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=b88a8ce4fc53c3a45830bc6bbde8b01c	Trust: 0.1
title:	Debian Security Advisories: DSA-5022-1 apache-log4j2 -- security update	url:	https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=5ba53229ef5f408ed29126bd4f624def	Trust: 0.1
title:	Red Hat: Low: Red Hat JBoss Enterprise Application Platform 7.4.4 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20221296 - Security Advisory	Trust: 0.1
title:	Red Hat: Low: Red Hat JBoss Enterprise Application Platform 7.4.4 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20221299 - Security Advisory	Trust: 0.1
title:	Red Hat: Low: Red Hat JBoss Enterprise Application Platform 7.4.4 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20221297 - Security Advisory	Trust: 0.1
title:	Amazon Linux AMI: ALAS-2021-1553	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2021-1553	Trust: 0.1
title:	IBM: Security Bulletin: IBM Cloud Pak System is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-45046, CVE-2021-44228)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c8b40ff47e1d31bee8b0fbdbdd4fe212	Trust: 0.1
title:	IBM: Security Bulletin: IBM Cloud Pak System is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-45046, CVE-2021-44228)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=654a4f5a7bd1fdfd229558535923710b	Trust: 0.1
title:	IBM: Security Bulletin: Apache log4j security vulnerability as it relates to IBM Maximo Scheduler Optimization â€“ Apache Log4j â€“ [CVE-2021-45105] (affecting v2.16) and [CVE-2021-45046] (affecting v2.15)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=1239b8de81ba381055ce95c571a45bea	Trust: 0.1
title:	Amazon Linux 2: ALAS2-2021-1731	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2021-1731	Trust: 0.1
title:	Amazon Linux 2: ALAS2-2021-1730	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2021-1730	Trust: 0.1
title:	Omada-Ansible	url:	https://github.com/kdpuvvadi/Omada-Ansible	Trust: 0.1
title:	CVE-2021-45046	url:	https://github.com/tejas-nagchandi/CVE-2021-45046	Trust: 0.1
title:	Log4Shell	url:	https://github.com/r00thunter/Log4Shell	Trust: 0.1
title:	log4j-exploit-server	url:	https://github.com/lwollan/log4j-exploit-server	Trust: 0.1
title:	log4j2-intranet-scan	url:	https://github.com/k3rwin/log4j2-intranet-scan	Trust: 0.1

sources: VULMON: CVE-2021-45046

EXTERNAL IDS

db:	NVD	id:	CVE-2021-45046	Trust: 2.7
db:	CERT/CC	id:	VU#930724	Trust: 1.8
db:	SIEMENS	id:	SSA-397453	Trust: 1.0
db:	SIEMENS	id:	SSA-714170	Trust: 1.0
db:	SIEMENS	id:	SSA-661247	Trust: 1.0
db:	SIEMENS	id:	SSA-479842	Trust: 1.0
db:	OPENWALL	id:	OSS-SECURITY/2021/12/18/1	Trust: 1.0
db:	OPENWALL	id:	OSS-SECURITY/2021/12/15/3	Trust: 1.0
db:	OPENWALL	id:	OSS-SECURITY/2021/12/14/4	Trust: 1.0
db:	VULMON	id:	CVE-2021-45046	Trust: 0.1
db:	PACKETSTORM	id:	169180	Trust: 0.1
db:	PACKETSTORM	id:	165326	Trust: 0.1
db:	PACKETSTORM	id:	165333	Trust: 0.1
db:	PACKETSTORM	id:	165343	Trust: 0.1
db:	PACKETSTORM	id:	165636	Trust: 0.1
db:	PACKETSTORM	id:	165645	Trust: 0.1
db:	PACKETSTORM	id:	165649	Trust: 0.1
db:	PACKETSTORM	id:	166673	Trust: 0.1

sources: CERT/CC: VU#930724 // VULMON: CVE-2021-45046 // PACKETSTORM: 169180 // PACKETSTORM: 165326 // PACKETSTORM: 165333 // PACKETSTORM: 165343 // PACKETSTORM: 165636 // PACKETSTORM: 165645 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // NVD: CVE-2021-45046

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html	Trust: 1.0
url:	https://www.oracle.com/security-alerts/alert-cve-2021-44228.html	Trust: 1.0
url:	https://security.gentoo.org/glsa/202310-16	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf	Trust: 1.0
url:	https://www.oracle.com/security-alerts/cpujul2022.html	Trust: 1.0
url:	http://www.openwall.com/lists/oss-security/2021/12/15/3	Trust: 1.0
url:	https://www.oracle.com/security-alerts/cpuapr2022.html	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/sig7fzulmnk2xf6fzru4vwydqxnmugaj/	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/eokpqgv24rrbbi4tbzudqmm4meh7mxcy/	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf	Trust: 1.0
url:	https://www.cve.org/cverecord?id=cve-2021-44228	Trust: 1.0
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-apache-log4j-qruknebd	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf	Trust: 1.0
url:	https://psirt.global.sonicwall.com/vuln-detail/snwlid-2021-0032	Trust: 1.0
url:	https://logging.apache.org/log4j/2.x/security.html	Trust: 1.0
url:	http://www.openwall.com/lists/oss-security/2021/12/14/4	Trust: 1.0
url:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2021-45046	Trust: 1.0
url:	https://www.oracle.com/security-alerts/cpujan2022.html	Trust: 1.0
url:	http://www.openwall.com/lists/oss-security/2021/12/18/1	Trust: 1.0
url:	https://www.kb.cert.org/vuls/id/930724	Trust: 1.0
url:	https://www.debian.org/security/2021/dsa-5022	Trust: 1.0
url:	cve-2021-4104	Trust: 0.8
url:	cve-2021-44228	Trust: 0.8
url:	cve-2021-45046	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-45046	Trust: 0.8
url:	https://access.redhat.com/security/cve/cve-2021-45046	Trust: 0.7
url:	https://listman.redhat.com/mailman/listinfo/rhsa-announce	Trust: 0.7
url:	https://bugzilla.redhat.com/):	Trust: 0.7
url:	https://access.redhat.com/security/team/contact/	Trust: 0.7
url:	https://access.redhat.com/security/vulnerabilities/rhsb-2021-009	Trust: 0.4
url:	https://access.redhat.com/security/cve/cve-2021-44832	Trust: 0.4
url:	https://nvd.nist.gov/vuln/detail/cve-2021-45105	Trust: 0.4
url:	https://access.redhat.com/security/cve/cve-2021-45105	Trust: 0.4
url:	https://nvd.nist.gov/vuln/detail/cve-2021-44832	Trust: 0.4
url:	https://nvd.nist.gov/vuln/detail/cve-2021-4104	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2021-4104	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2021-44228	Trust: 0.3
url:	https://access.redhat.com/security/updates/classification/#critical	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2021-44228	Trust: 0.3
url:	https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html	Trust: 0.2
url:	https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html	Trust: 0.2
url:	https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/	Trust: 0.2
url:	https://access.redhat.com/security/updates/classification/#low	Trust: 0.2
url:	https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/	Trust: 0.2
url:	https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=appplatform&version=7.4	Trust: 0.2
url:	https://access.redhat.com/security/updates/classification/#moderate	Trust: 0.2
url:	https://www.debian.org/security/faq	Trust: 0.1
url:	https://security-tracker.debian.org/tracker/apache-log4j2	Trust: 0.1
url:	https://www.debian.org/security/	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2021:5141	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2021:5106	Trust: 0.1
url:	https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2021-43527	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2021:5107	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2021-43527	Trust: 0.1
url:	https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2022:0216	Trust: 0.1
url:	https://access.redhat.com/solutions/6577421	Trust: 0.1
url:	https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=data.grid&version=8.2	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2022:0205	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1	Trust: 0.1
url:	https://access.redhat.com/articles/11258	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2022:0222	Trust: 0.1
url:	https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=red.hat.integration&version	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2022-23307	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2022-23302	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2022-23305	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2022:1299	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2022-23302	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2022-23305	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2022-23307	Trust: 0.1
url:	https://issues.jboss.org/):	Trust: 0.1

sources: CERT/CC: VU#930724 // PACKETSTORM: 169180 // PACKETSTORM: 165326 // PACKETSTORM: 165333 // PACKETSTORM: 165343 // PACKETSTORM: 165636 // PACKETSTORM: 165645 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // NVD: CVE-2021-45046

CREDITS

Much of the content of this vulnerability note is derived from Apache Log4j Security Vulnerabilities and http://slf4j.org/log4shell.html.This document was written by Art Manion.

Trust: 0.8

sources: CERT/CC: VU#930724

SOURCES

db:	CERT/CC	id:	VU#930724
db:	VULMON	id:	CVE-2021-45046
db:	PACKETSTORM	id:	169180
db:	PACKETSTORM	id:	165326
db:	PACKETSTORM	id:	165333
db:	PACKETSTORM	id:	165343
db:	PACKETSTORM	id:	165636
db:	PACKETSTORM	id:	165645
db:	PACKETSTORM	id:	165649
db:	PACKETSTORM	id:	166673
db:	NVD	id:	CVE-2021-45046

LAST UPDATE DATE

2025-11-28T19:49:14.913000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#930724	date:	2022-02-07T00:00:00
db:	VULMON	id:	CVE-2021-45046	date:	2023-10-26T00:00:00
db:	NVD	id:	CVE-2021-45046	date:	2025-10-27T17:35:56.240

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#930724	date:	2021-12-15T00:00:00
db:	VULMON	id:	CVE-2021-45046	date:	2021-12-14T00:00:00
db:	PACKETSTORM	id:	169180	date:	2021-12-28T20:12:00
db:	PACKETSTORM	id:	165326	date:	2021-12-16T15:22:54
db:	PACKETSTORM	id:	165333	date:	2021-12-16T15:34:27
db:	PACKETSTORM	id:	165343	date:	2021-12-17T14:05:45
db:	PACKETSTORM	id:	165636	date:	2022-01-20T17:49:52
db:	PACKETSTORM	id:	165645	date:	2022-01-20T18:11:03
db:	PACKETSTORM	id:	165649	date:	2022-01-21T15:29:08
db:	PACKETSTORM	id:	166673	date:	2022-04-11T17:07:22
db:	NVD	id:	CVE-2021-45046	date:	2021-12-14T19:15:07.733