CVE-2021-45046

Publication date 14 December 2021

Last updated 21 August 2024

Ubuntu priority

Cvss 3 Severity Score

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache-log4j2	22.04 LTS jammy	Not affected
	21.10 impish	Fixed 2.16.0-0.21.10.1
	21.04 hirsute	Fixed 2.16.0-0.21.04.1
	20.04 LTS focal	Fixed 2.16.0-0.20.04.1
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release

Notes

alexmurray

Ubuntu 18.04 LTS is not affected since the JndiLookup.class was removed in the previous update for CVE-2021-44228

ebarretto

above is also true for Ubuntu 16.04 ESM

Severity score breakdown

Parameter	Value
Base score	3.7 · Low
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Related Ubuntu Security Notices (USN)

USN-5197-1
Apache Log4j 2 vulnerability
15 December 2021