CVE record
CVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
CVE evidence
Known exploitation
Listed in CISA KEV
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
critical
CVSS 9.0 · CVSS_V3
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
CISA Known Exploited Vulnerabilities
Catalog record
- Vendor / project
- Apache
- Product
- Log4j2
- Date added
- May 1, 2023
- CISA federal remediation due date
- May 22, 2023
- Required action
- Apply updates per vendor instructions.
- Known ransomware campaign use
- Known
- CWE
- CWE-917
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| org.apache.logging.log4j:log4j-core | maven | 2.16.0, 2.12.2 |
| org.ops4j.pax.logging:pax-logging-log4j2 | maven | 1.9.2, 1.10.8, 1.11.11, 2.0.12 |