Critical severity9.0CISA KEVNVD Advisory· Published Dec 14, 2021· Updated Jun 17, 2026

CVE-2021-45046

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.logging.log4j:log4j-coreMaven	>= 2.13.0, < 2.16.0	2.16.0
org.apache.logging.log4j:log4j-coreMaven	< 2.12.2	2.12.2
org.ops4j.pax.logging:pax-logging-log4j2Maven	>= 1.8.0, < 1.9.2	1.9.2
org.ops4j.pax.logging:pax-logging-log4j2Maven	>= 1.10.0, < 1.10.8	1.10.8
org.ops4j.pax.logging:pax-logging-log4j2Maven	>= 1.11.0, < 1.11.11	1.11.11
org.ops4j.pax.logging:pax-logging-log4j2Maven	>= 2.0.0, < 2.0.12	2.0.12

Affected products

Apache/Log4j5 versions
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*range: >=2.0.1,<2.12.2
- cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*
- cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*
Cvat/Computer Vision Annotation Tool
cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:*
Intel/Audio Development Kit
cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*
Intel/Datacenter Manager
cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:*
Intel/Genomics Kernel Library
cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*
Intel/Oneapi
cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:*
Intel/Secure Device Onboard
cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*
Intel/Sensor Solution Firmware Development Kit
cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*
Intel/System Debugger
cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*
Intel/System Studio
cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*
Siemens Foundation/Captial3 versions
cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*range: <2019.1
- cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*
Siemens Foundation/Comos
cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*
Siemens Foundation/Desigo Cc Advanced Reports5 versions
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*
Siemens Foundation/Desigo Cc Info Center2 versions
cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*
Siemens Foundation/E Car Operation Center
cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*
Range: <2021-12-13
Siemens Foundation/Energy Engage
cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*
Siemens Foundation/Energyip4 versions
cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*
Siemens Foundation/Energyip Prepay2 versions
cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*
Siemens Foundation/GMA-Manager
cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*
Range: <8.6.2j-398
Siemens Foundation/Head End System Universal Device Integration System
cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*
Siemens Foundation/Industrial Edge Management
cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*
Siemens Foundation/Industrial Edge Management Hub
cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*
Range: <2021-12-13
Siemens Foundation/Logo\! Soft Comfort
cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*
Siemens Foundation/Mendix
cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*
Siemens Foundation/Mindsphere
cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*
Range: <2021-12-11
Siemens Foundation/Navigator
cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*
Range: <2021-12-13
Siemens Foundation/NX
cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*
Siemens Foundation/Opcenter Intelligence
cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*
Range: <=3.2
Siemens Foundation/Operation Scheduler
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*
Range: <=1.1.3
Siemens Foundation/Sentron Powermanager2 versions
cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*
Siemens Foundation/Siguard Dsa3 versions
cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*
Siemens Foundation/Sipass Integrated2 versions
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*
Siemens Foundation/Siveillance Command
cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*
Range: <=4.16.2.1
Siemens Foundation/Siveillance Control Pro
cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*
Siemens Foundation/Siveillance Identity2 versions
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*
Siemens Foundation/Siveillance Vantage
cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*
Siemens Foundation/Siveillance Viewpoint
cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*
Siemens Foundation/Solid Edge Cam Pro
cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*
Siemens Foundation/Solid Edge Harness Design4 versions
cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*range: <2020
- cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*
Siemens Foundation/Spectrum Power 44 versions
cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*range: <4.70
- cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*
- cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*
Siemens Foundation/Spectrum Power 74 versions
cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*range: <2.30
- cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*
Siemens Foundation/Teamcenter
cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*
Siemens Foundation/Tracealertserverplus
cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:*
Siemens Foundation/Vesys4 versions
cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*range: <2019.1
- cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*
Siemens Foundation/Xpedition Enterprise
cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*
Siemens Foundation/Xpedition Package Integrator
cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*
SonicWall/Email Security
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*
Range: <10.0.12
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Siemens Foundation/6bk1602 0aa12 0tp0 Firmware
cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*
Range: <2.7.0
Siemens Foundation/6bk1602 0aa22 0tp0 Firmware
cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*
Range: <2.7.0
Siemens Foundation/6bk1602 0aa32 0tp0 Firmware
cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*
Range: <2.7.0
Siemens Foundation/6bk1602 0aa42 0tp0 Firmware
cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*
Range: <2.7.0
Siemens Foundation/6bk1602 0aa52 0tp0 Firmware
cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*
Range: <2.7.0
Siemens Foundation/Sppa T3000 Ses3000 Firmware
cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*
ghsa-coords9 versions
pkg:maven/org.apache.logging.log4j/log4j-core pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2 pkg:rpm/opensuse/disruptor&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/disruptor&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/jakarta-servlet&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/jakarta-servlet&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/log4j&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/log4j&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/log4j&distro=openSUSE%20Tumbleweed
>= 2.13.0, < 2.16.0+ 8 more
- (no CPE)range: >= 2.13.0, < 2.16.0
- (no CPE)range: >= 1.8.0, < 1.9.2
- (no CPE)range: < 3.4.4-lp152.2.3.1
- (no CPE)range: < 3.4.4-3.3.1
- (no CPE)range: < 5.0.0-lp152.2.1
- (no CPE)range: < 5.0.0-5.3.1
- (no CPE)range: < 2.16.0-lp152.3.9.1
- (no CPE)range: < 2.13.0-4.6.1
- (no CPE)range: < 2.16.0-2.1
Apache Software Foundation/Apache Log4jv5
Range: Apache Log4j2

Patches

Vulnerability mechanics

References

www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2021/12/14/4nvdMailing ListMitigationThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2021/12/15/3nvdMailing ListThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2021/12/18/1nvdMailing ListThird Party AdvisoryWEB
cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfnvdThird Party AdvisoryWEB
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfnvdThird Party AdvisoryWEB
cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfnvdThird Party AdvisoryWEB
cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-7rjr-3q55-vv33ghsaADVISORY
github.com/advisories/GHSA-jfh8-c2jp-5v3qghsaADVISORY
logging.apache.org/log4j/2.x/security.htmlnvdMitigationRelease NotesVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-45046ghsaADVISORY
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032nvdThird Party AdvisoryWEB
security.gentoo.org/glsa/202310-16nvdThird Party AdvisoryWEB
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdnvdThird Party AdvisoryWEB
www.debian.org/security/2021/dsa-5022nvdThird Party AdvisoryWEB
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.htmlnvdThird Party AdvisoryWEB
www.kb.cert.org/vuls/id/930724nvdThird Party AdvisoryUS Government ResourceWEB
www.oracle.com/security-alerts/alert-cve-2021-44228.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdThird Party AdvisoryWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCYghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/nvdMailing ListRelease Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/nvdMailing ListRelease Notes
lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCYghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJghsaWEB
sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdghsaWEB
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government ResourceWEB
www.cve.org/CVERecordnvdNot ApplicableWEB
www.openwall.com/lists/oss-security/2021/12/14/4ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.080
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.060