CVE-2021-45046

KEVRansomware UseApache Log4j2 Deserialization of Untrusted Data Vulnerability

Description

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

PublishedDec 14, 2021

Last modifiedJun 17, 2026

Added to KEVMay 1, 2023

Remediation dueMay 22, 2023

References

openwall.com/lists/oss-security/2021/12/14/4Mailing ListMitigation
openwall.com/lists/oss-security/2021/12/15/3Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2021/12/18/1Mailing ListThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/Mailing ListRelease Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/Mailing ListRelease Notes
logging.apache.org/log4j/2.x/security.htmlMitigationRelease Notes
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032Third Party Advisory
security.gentoo.org/glsa/202310-16Third Party Advisory

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1255 days
Ransomware: Used in known ransomware campaigns
CVSS: 9.0 CRITICAL
EPSS (30-day exploit probability): 100.0% · top 1% of all CVEs
Weakness: CWE-917
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.