Apache Log4j<2.16.0拒绝服务漏洞

详细信息

漏洞类型

通用软硬件漏洞

漏洞描述

Apache Log4j 2.15.0对漏洞CVE-2021-44228的不完全修复。在某些非默认配置中不完整。当日志记录配置使用带有上下文查找（例如，$${ctx:loginId}）或线程上下文映射模式（%X、%MDC或%MDC）的非默认模式布局时，这可能允许控制线程上下文映射（MDC）输入数据的攻击者使用JNDI查找模式手工生成恶意输入数据，从而导致拒绝服务（DOS）攻击。Log4j 2.15.0默认情况下，将JNDI LDAP查找限制为本地主机。请注意，以前的缓解措施涉及配置，例如设置系统属性log4j2.noFormatMsgLookup为true`不能缓解此特定漏洞。Log4j 2.16.0通过删除对消息查找模式的支持并默认禁用JNDI功能来修复此问题。在以前的版本（<2.16.0）中，可以通过从classpath中删除JndiLookup类（例如：zip-q-dlog4jcore-*.jarorg/apache/logging/log4j/core/lookup/JndiLookup.class）来缓解此问题。

修复建议

升级至最新版本的Log4j（2.12.2或2.16.0或更高版本），可从Apache网站获得: https://logging.apache.org/log4j/2.x/security.html

参考链接

• https://logging.apache.org/log4j/2.x/security.html

  OSV · x_refsource_CONFIRM

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html

  OSV · x_refsource_CONFIRM

• http://www.openwall.com/lists/oss-security/2021/12/15/3

  OSV · mailing-list · x_refsource_MLIST

• https://www.oracle.com/security-alerts/cpujan2022.html

  OSV · x_refsource_MISC

• https://www.oracle.com/security-alerts/cpuapr2022.html

  OSV · x_refsource_MISC

• https://security.gentoo.org/glsa/202310-16

  OSV · Third Party Advisory

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

  OSV · vendor-advisory · x_refsource_CISCO

• https://www.oracle.com/security-alerts/alert-cve-2021-44228.html

  OSV · x_refsource_CONFIRM

• https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf

  OSV · x_refsource_CONFIRM

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

  OSV · vendor-advisory · x_refsource_FEDORA

• http://www.openwall.com/lists/oss-security/2021/12/18/1

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/12/14/4

  OSV · mailing-list · x_refsource_MLIST

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

  OSV · vendor-advisory · x_refsource_FEDORA

• https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

  OSV · x_refsource_CONFIRM

• https://www.oracle.com/security-alerts/cpujul2022.html

  OSV · x_refsource_MISC

• https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

  OSV · x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2021-44228

  OSV · x_refsource_MISC

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

  OSV · x_refsource_CONFIRM

• https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

  OSV · x_refsource_CONFIRM

• https://www.debian.org/security/2021/dsa-5022

  OSV · vendor-advisory · x_refsource_DEBIAN

• https://www.kb.cert.org/vuls/id/930724

  OSV · third-party-advisory · x_refsource_CERT-VN

• https://security.paloaltonetworks.com/CVE-2021-44228
• https://supportportal.juniper.net/s/article/2021-12-Out-of-Cycle-Security-Advisory-Multiple-Products-Apache-Log4j2-JNDI-features-do-not-protect-against-attacker-controlled-LDAP-and-other-JNDI-related-endpoints-CVE-2021-44228-CVE-2021-4104-CVE-2021-45046-and-CVE-2021-42550
• https://nvd.nist.gov/vuln/detail/CVE-2021-45046

  OSV

• https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

  OSV

• https://www.openwall.com/lists/oss-security/2021/12/14/4

  OSV · Mailing List · Mitigation · Third Party Advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

  GitHub

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

  GitHub

• https://github.com/advisories/GHSA-7rjr-3q55-vv33

  GitHub

• https://osv.dev/vulnerability/DSA-5022-1

  OSV

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY

  OSV · Release Notes · Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ

  OSV · Release Notes · Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY

  OSV

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ

  OSV

• https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33

  OSV

• https://osv.dev/vulnerability/CVE-2021-45046

  OSV

• https://security-tracker.debian.org/tracker/CVE-2021-45046

  OSV

• https://ubuntu.com/security/CVE-2021-45046

  OSV

• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell

  OSV

• https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f

  OSV

• https://issues.apache.org/jira/browse/LOG4J2-3221

  OSV

• https://ubuntu.com/security/notices/USN-5197-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2021-45046

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45046

  OSV

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

  GitHub

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45046

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046

  NVD · US Government Resource