一、漏洞信息

漏洞编号：[CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046)

漏洞归属的版本：2.17.2

CVSS V3.0分值：

BaseScore：9.0 Critical

Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

漏洞简述：

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

漏洞公开时间：2021-12-15 03:15:07

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-45046

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/14/4 | |

| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/15/3 | |

| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/18/1 | |

| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf | |

| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf | |

| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf | |

| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf | |

| security.apache.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ | |

| security.apache.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ | |

| security.apache.org | https://logging.apache.org/log4j/2.x/security.html | |

| security.apache.org | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 | |

| security.apache.org | https://security.gentoo.org/glsa/202310-16 | |

| security.apache.org | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd | |

| security.apache.org | https://www.cve.org/CVERecord?id=CVE-2021-44228 | |

| security.apache.org | https://www.debian.org/security/2021/dsa-5022 | |

| security.apache.org | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html | |

| security.apache.org | https://www.kb.cert.org/vuls/id/930724 | |

| security.apache.org | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html | |

| security.apache.org | https://www.oracle.com/security-alerts/cpuapr2022.html | |

| security.apache.org | https://www.oracle.com/security-alerts/cpujan2022.html | |

| security.apache.org | https://www.oracle.com/security-alerts/cpujul2022.html | |

| suse_bugzilla | https://logging.apache.org/log4j/2.x/security.html | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-44228 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-45046 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |

| suse_bugzilla | http://seclists.org/oss-sec/2021/q4/159 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |

| redhat_bugzilla | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://logging.apache.org/log4j/2.x/security.html | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5148 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5106 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5141 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5107 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2021-45046 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0203 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0205 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0083 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0216 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0222 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0223 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1296 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1297 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1299 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |

| ubuntu | https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://issues.apache.org/jira/browse/LOG4J2-3221 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://ubuntu.com/security/notices/USN-5197-1 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2021-45046 |

| oracle | | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |

| log4j | https://issues.apache.org/jira/browse/LOG4J2-2819 | https://logging.apache.org/log4j/2.x/security.html |

| log4j | https://issues.apache.org/jira/browse/LOG4J2-1863 | https://logging.apache.org/log4j/2.x/security.html |

| gentoo | | https://security.gentoo.org/glsa/202310-16 |

| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2021-45046 |

| cve_search | | http://www.openwall.com/lists/oss-security/2021/12/14/4 |

| cve_search | | https://logging.apache.org/log4j/2.x/security.html |

| cve_search | | https://www.cve.org/CVERecord?id=CVE-2021-44228 |

| cve_search | | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html |

| cve_search | | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd |

| cve_search | | http://www.openwall.com/lists/oss-security/2021/12/15/3 |

| cve_search | | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf |

| cve_search | | https://www.kb.cert.org/vuls/id/930724 |

| cve_search | | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf |

| cve_search | | https://www.debian.org/security/2021/dsa-5022 |

| cve_search | | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |

| cve_search | | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 |

| cve_search | | http://www.openwall.com/lists/oss-security/2021/12/18/1 |

| cve_search | | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf |

| cve_search | | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf |

| cve_search | | https://www.oracle.com/security-alerts/cpujan2022.html |

| cve_search | | https://www.oracle.com/security-alerts/cpuapr2022.html |

| cve_search | | https://www.oracle.com/security-alerts/cpujul2022.html |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ |

| cve_search | | https://security.gentoo.org/glsa/202310-16 |

| gradle | | https://security.gradle.com/advisory/2021-11 |

| kafka | | https://kafka.apache.org/cve-list |

| github_advisory | https://www.cve.org/CVERecord?id=CVE-2021-44228 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.oracle.com/security-alerts/cpuapr2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.oracle.com/security-alerts/cpujan2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/15/3 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/18/1 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.oracle.com/security-alerts/cpujul2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://logging.apache.org/log4j/2.x/security.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2021-45046 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://github.com/advisories/GHSA-jfh8-c2jp-5v3q | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/14/4 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.debian.org/security/2021/dsa-5022 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

| github_advisory | https://www.kb.cert.org/vuls/id/930724 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

</details>

漏洞分析指导链接：

https://gitee.com/openlookeng/community/blob/master/security/cve/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | http://www.openwall.com/lists/oss-security/2021/12/14/4 | | nvd |

| | | http://www.openwall.com/lists/oss-security/2021/12/15/3 | | nvd |

| | | http://www.openwall.com/lists/oss-security/2021/12/18/1 | | nvd |

| | | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf | | nvd |

| | | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf | | nvd |

| | | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf | | nvd |

| | | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf | | nvd |

| | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ | | nvd |

| | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ | | nvd |

| | | https://logging.apache.org/log4j/2.x/security.html | | nvd |

| | | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 | | nvd |

| | | https://security.gentoo.org/glsa/202310-16 | | nvd |

| | | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd | | nvd |

| | | https://www.cve.org/CVERecord?id=CVE-2021-44228 | | nvd |

| | | https://www.debian.org/security/2021/dsa-5022 | | nvd |

| | | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html | | nvd |

| | | https://www.kb.cert.org/vuls/id/930724 | | nvd |

| | | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html | | nvd |

| | | https://www.oracle.com/security-alerts/cpuapr2022.html | | nvd |

| | | https://www.oracle.com/security-alerts/cpujan2022.html | | nvd |

| | | https://www.oracle.com/security-alerts/cpujul2022.html | | nvd |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openLooKeng评分：