Vulnerability in org.apache.logging.log4j:log4j-core (CVE-2021-45105, CVSS 5.9)

Summary

Vulnerability in org.apache.logging.log4j:log4j-core (CVE-2021-45105). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.3.1 or later.

Original description

The description as published by the source.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-45105 has been found in org.apache.logging.log4j:log4j-core.
Risk of unauthorized operations or information disclosure. CVSS score: 5.9/10.
What to do: upgrade org.apache.logging.log4j:log4j-core to 2.3.1 or later.
If unsure, ask your IT team or search "org.apache.logging.log4j:log4j-core CVE-2021-45105" on the vendor's site.

CVE-2021-45105 (org.apache.logging.log4j:log4j-core) — CWE-20 / CVSS v3 5.9
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 2.3.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-20) exists in org.apache.logging.log4j:log4j-core.

📍 Affected scope

Check the vendor advisory for the affected versions of org.apache.logging.log4j:log4j-core.

🔥 Severity

Severity: Medium (CVSS 5.9/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 2.3.1.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
資産台帳・SBOM・依存マニフェストで org.apache.logging.log4j:log4j-core を使っているサービスとバージョンを洗い出す。
2
Apply patch patch
```
Upgrade org.apache.logging.log4j:log4j-core to 2.3.1
```
ステージング環境で 2.3.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

maven org.apache.logging.log4j:log4j-core

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}]

maven org.ops4j.pax.logging:pax-logging-log4j2

[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-45105 apache-log4j2 Fixed in: 2.17.0-1
Ubuntu UBUNTU-CVE-2021-45105 apache-log4j2