CVE-2021-45105 in apache log4j
The LogPulse agent checks every host for the vulnerable version of this software, so you see where the CVE is present.
What the vulnerability is
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Affected software: apache log4j, netapp cloud manager, sonicwall email security, sonicwall network security manager, sonicwall web application firewall, oracle agile engineering data management, oracle agile plm mcad connector, oracle agile product lifecycle management, oracle autovue for agile product lifecycle management, oracle banking deposits and lines of credit servicing
Scores
- CVSS: 5.9 (medium)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2021-12-18
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.