CVE-2021-45105 is a security vulnerability found in Apache Log4j2, a widely used logging library. Rated as a medium severity issue, it affects systems running Log4j2 versions 2.0-alpha1 through 2.16.0, excluding 2.12.3 and 2.3.1. The vulnerability allows an attacker to cause a denial of service by exploiting uncontrolled recursion from self-referential lookups. Various systems, including Apache Log4j, NetApp Cloud Manager, and Debian Linux, are impacted by this vulnerability. To protect your system, it's essential to update to the fixed Log4j versions or apply recommended mitigations.

How do I know if I'm affected?

If you're using Apache Log4j2, you might be affected by the vulnerability. This issue impacts Log4j2 versions 2.0-alpha1 through 2.16.0, excluding 2.12.3 and 2.3.1. The vulnerability can cause a denial of service due to uncontrolled recursion from self-referential lookups. To know if you're affected, check the version of Log4j2 you're using. If it falls within the affected range, your system might be vulnerable. Note that this issue doesn't directly affect Apple products, but it can impact other software and systems that use the vulnerable Log4j2 versions.

What should I do if I'm affected?

If you're affected by the vulnerability, take these steps. First, upgrade to Log4j 2.17.0 (Java 8 or later), 2.12.3 (Java 7), or 2.3.1 (Java 6). Then, in your logging configuration, replace Context Lookups with Thread Context Map patterns (%X, %mdc, or %MDC). Remove references to Context Lookups from external sources like HTTP headers or user input.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

As of now, CVE-2021-45105 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, found in Apache Log4j2, allows an attacker to cause a denial of service by exploiting uncontrolled recursion from self-referential lookups.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-674 and CWE-20, which involves uncontrolled recursion, which can lead to a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

For more details

CVE-2021-45105 is a medium-severity vulnerability in Apache Log4j2 that can lead to denial of service through uncontrolled recursion. After analyzing various sources, it's clear that updating to Log4j 2.17.0, 2.12.3, or 2.3.1 is crucial for mitigating this issue. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• oss-security - CVE-2021-45105: Apache Log4j2

• Log4j Security Page

• NetApp Product Security Advisory

• Cisco Security Advisory