Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 18 Dec 2021 18:02:02 -0600
From: Matt Sicker <mattsicker@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-45105: Apache Log4j2 does not always protect from infinite
 recursion in lookup evaluation

Severity: high

Description:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3)
did not protect from uncontrolled recursion from self-referential
lookups. This allows an attacker with control over Thread Context Map
data to cause a denial of service when a crafted string is
interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.

This issue is being tracked as LOG4J2-3230

Mitigation:

Implement one of the following mitigation techniques:

* Java 8 (or later) users should upgrade to release 2.17.0.

Alternatively, this can be mitigated in configuration:

* In PatternLayout in the logging configuration, replace Context
Lookups like `${ctx:loginId}` or `$${ctx:loginId}` with Thread Context
Map patterns (%X, %mdc, or %MDC).
* Otherwise, in the configuration, remove references to Context
Lookups like `${ctx:loginId}` or `$${ctx:loginId}` where they
originate
from sources external to the application such as HTTP headers or user input.

Credit:

Independently discovered by Hideki Okamoto of Akamai Technologies, Guy
Lederfein of Trend Micro Research working with Trend Micro’s Zero Day
Initiative, and another anonymous vulnerability researcher

References:

https://logging.apache.org/log4j/2.x/security.html


-- 
Matt Sicker
PMC Member, Logging Services, Apache Software Foundation

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.