Critical Vulnerability in Apache Log4j Java Logging Library
On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed:
CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
For a description of this vulnerability, see the Fixed in Log4j 2.15.0 section of the Apache Log4j Security Vulnerabilities page.
Low-Impact Vulnerability in Apache Log4j Java Logging Library
On December 14, 2021, the following low-impact vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was discovered:
CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
For a description of this vulnerability, see the Fixed in Log4j 2.12.2 and Log4j 2.16.0 section of the Apache Log4j Security Vulnerabilities page.
Cisco’s Response to These Vulnerabilities
Cisco is assessing all products and services for impact from both CVE-2021-44228 and CVE-2021-45046.
To help detect exploitation of this vulnerability, Cisco has released Snort rules at the following location: Talos Rules 2021-12-14
This advisory will be updated daily around the following times: 1500 UTC/10:00 AM ET, 1900 UTC/2:00 PM ET, 2300 UTC/6:00 PM ET.
This advisory is available at the following link:
Security Impact Rating: Critical
Source:: Cisco Security Advisories