{"id":"CVE-2021-45046","details":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","aliases":["GHSA-7rjr-3q55-vv33"],"modified":"2026-08-07T11:49:17.310315884Z","published":"2021-12-14T19:15:07.733Z","related":["openSUSE-SU-2021:1601-1","openSUSE-SU-2021:4094-1","openSUSE-SU-2021:4107-1","openSUSE-SU-2024:11681-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2019.1"}],"source":"CPE_RANGE","vendor_product":"siemens:captial"},{"source":"CPE_RANGE","vendor_product":"siemens:e-car_operation_center","cpes":["cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2021-12-13"}]},{"vendor_product":"siemens:gma-manager","cpes":["cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"8.6.2j-398"}],"source":"CPE_RANGE"},{"extracted_events":[{"fixed":"2021-12-13"}],"source":"CPE_RANGE","vendor_product":"siemens:industrial_edge_management_hub","cpes":["cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"fixed":"2021-12-11"}],"source":"CPE_RANGE","vendor_product":"siemens:mindsphere","cpes":["cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*"]},{"vendor_product":"siemens:navigator","cpes":["cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2021-12-13"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"siemens:opcenter_intelligence","cpes":["cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"3.2"}]},{"extracted_events":[{"last_affected":"1.1.3"}],"source":"CPE_RANGE","vendor_product":"siemens:operation_scheduler","cpes":["cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"last_affected":"4.16.2.1"}],"source":"CPE_RANGE","vendor_product":"siemens:siveillance_command","cpes":["cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*"]},{"source":"CPE_RANGE","vendor_product":"siemens:solid_edge_harness_design","cpes":["cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2020"}]},{"cpes":["cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"4.70"}],"source":"CPE_RANGE","vendor_product":"siemens:spectrum_power_4"},{"source":"CPE_RANGE","vendor_product":"siemens:vesys","cpes":["cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2019.1"}]},{"vendor_product":"sonicwall:email_security","cpes":["cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"10.0.12"}],"source":"CPE_RANGE"},{"cpes":["cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0-beta9"},{"last_affected":"2.0-beta9"},{"introduced":"2.0-rc1"},{"last_affected":"2.0-rc1"},{"introduced":"2.0-rc2"},{"last_affected":"2.0-rc2"}],"source":"CPE_STRING","vendor_product":"apache:log4j"},{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"11.0"},{"last_affected":"11.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"siemens:captial","cpes":["cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*","cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2019.1-NA"},{"last_affected":"2019.1-NA"},{"introduced":"2019.1-sp1912"},{"last_affected":"2019.1-sp1912"}]},{"vendor_product":"siemens:desigo_cc_advanced_reports","cpes":["cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*","cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*","cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*","cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*","cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"},{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.2"},{"last_affected":"4.2"},{"introduced":"5.0"},{"last_affected":"5.0"},{"introduced":"5.1"},{"last_affected":"5.1"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"5.0"},{"last_affected":"5.0"},{"introduced":"5.1"},{"last_affected":"5.1"}],"source":"CPE_STRING","vendor_product":"siemens:desigo_cc_info_center","cpes":["cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*","cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*"]},{"vendor_product":"siemens:energy_engage","cpes":["cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.1"},{"last_affected":"3.1"}],"source":"CPE_STRING"},{"vendor_product":"siemens:energyip","cpes":["cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*","cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*","cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*","cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.5"},{"last_affected":"8.5"},{"introduced":"8.6"},{"last_affected":"8.6"},{"introduced":"8.7"},{"last_affected":"8.7"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING"},{"vendor_product":"siemens:energyip_prepay","cpes":["cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*","cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.7"},{"last_affected":"3.7"},{"introduced":"3.8"},{"last_affected":"3.8"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"siemens:sentron_powermanager","cpes":["cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*","cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.2"},{"last_affected":"4.2"}]},{"source":"CPE_STRING","vendor_product":"siemens:siguard_dsa","cpes":["cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*","cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*","cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.2"},{"last_affected":"4.2"},{"introduced":"4.3"},{"last_affected":"4.3"},{"introduced":"4.4"},{"last_affected":"4.4"}]},{"extracted_events":[{"introduced":"2.80"},{"last_affected":"2.80"},{"introduced":"2.85"},{"last_affected":"2.85"}],"source":"CPE_STRING","vendor_product":"siemens:sipass_integrated","cpes":["cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*","cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"siemens:solid_edge_harness_design","cpes":["cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*","cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*","cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2020"},{"last_affected":"2020"},{"introduced":"2020-NA"},{"last_affected":"2020-NA"},{"introduced":"2020-sp2002"},{"last_affected":"2020-sp2002"}]},{"source":"CPE_STRING","vendor_product":"siemens:spectrum_power_4","cpes":["cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*","cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*","cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.70-NA"},{"last_affected":"4.70-NA"},{"introduced":"4.70-sp7"},{"last_affected":"4.70-sp7"},{"introduced":"4.70-sp8"},{"last_affected":"4.70-sp8"}]},{"cpes":["cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.30-sp2"},{"last_affected":"2.30-sp2"}],"source":"CPE_STRING","vendor_product":"siemens:spectrum_power_7"},{"cpes":["cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*","cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*","cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2019.1"},{"last_affected":"2019.1"},{"introduced":"2019.1-NA"},{"last_affected":"2019.1-NA"},{"introduced":"2019.1-sp1912"},{"last_affected":"2019.1-sp1912"}],"source":"CPE_STRING","vendor_product":"siemens:vesys"}]},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2021-44228"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/12/14/4"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/12/15/3"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/12/18/1"},{"type":"ADVISORY","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"},{"type":"ADVISORY","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"},{"type":"ADVISORY","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"},{"type":"ADVISORY","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/"},{"type":"ADVISORY","url":"https://logging.apache.org/log4j/2.x/security.html"},{"type":"ADVISORY","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202310-16"},{"type":"ADVISORY","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-5022"},{"type":"ADVISORY","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"},{"type":"ADVISORY","url":"https://www.kb.cert.org/vuls/id/930724"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/logging-log4j2","events":[{"introduced":"6b788facd3479dfe9052b3a5e13f6603dce8c16f"},{"fixed":"ad361d2e517e765f69db464d9407ac2dd80bc93e"},{"introduced":"9dcb1823a0a0192f2016daf7c1445ddfb3435fbf"},{"fixed":"cffe58f6a433ea1ab60ceb129d4c9b3377acda1d"},{"introduced":"8d9204a4b4c6016fa6b36513a46502689d6a45c1"},{"last_affected":"8d9204a4b4c6016fa6b36513a46502689d6a45c1"}],"database_specific":{"cpe":["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0.1"},{"fixed":"2.12.2"},{"introduced":"2.13.0"},{"fixed":"2.16.0"},{"introduced":"2.0-NA"},{"last_affected":"2.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["2.0-NA","log4j-2.15.1-rc1","rel/2.15.0","log4j-2.15.0-rc2","log4j-2.15.0-rc1","rel/2.14.1","log4j-2.14.1-rc1","rel/2.14.0","log4j-2.14.0-rc1","rel/2.13.3","log4j-2.13.3-rc1","log4j-2.13.3","rel/2.13.2","log4j-2.13.2-rc1","log4j-2.13.2","rel/2.13.1","log4j-2.13.1-rc2","log4j-2.13.1","log4j-2.13.1-rc1","rel/2.13.0","log4j-2.13.0-rc2","rel/2.0","log4j-2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-45046.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cvat-ai/cvat","events":[{"introduced":"0"},{"fixed":"552bd5393974b34a843e21ce266ee420e704e875"},{"fixed":"b23fe72ddfac28c039bfab2eedbb1a5b51b1e2b5"},{"introduced":"56c9626a3a6762ba8f670b491e63c72a3ddda0f0"},{"last_affected":"552bd5393974b34a843e21ce266ee420e704e875"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.30"},{"fixed":"2.7.0"},{"introduced":"1.5"},{"last_affected":"1.5"},{"introduced":"1.6"},{"last_affected":"1.6"},{"introduced":"2.30"},{"last_affected":"2.30"},{"introduced":"2.30-NA"},{"last_affected":"2.30-NA"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*","cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*","cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*","cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*","cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*","cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*"]}}],"versions":["1.5","1.6","2.30","v2.30.0","v2.29.0","v2.28.0","v2.27.0","v2.26.1","v2.26.0","v2.25.0","v2.24.0","v2.23.1","v2.23.0","v2.22.0","v2.21.3","v2.21.2","v2.21.1","v2.21.0","v2.20.0","v2.19.1","v2.19.0","v2.18.0","v2.17.0","v2.16.3","v2.16.2","v2.16.1","v2.16.0","v2.15.0","v2.14.4","v2.10.2","v2.14.3","v2.14.2","v2.14.1","v2.14.0","v2.13.0","v2.12.1","v2.12.0","v2.11.3","v2.11.2","v2.11.1","v2.11.0","v2.10.3","v2.10.1","v2.10.0","v2.9.2","v2.9.1","v2.9.0","v2.8.2","v2.8.1","v2.8.0","v2.7.6","v2.7.5","v2.7.4","v2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.2","v2.6.1","v2.6.0","v2.5.2","v2.5.1","v2.5.0","v2.4.9","v2.4.8","v2.4.7","v2.4.6","v2.4.5","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.7.0","v1.6.0","v1.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-45046.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}