CVE-2021-45046

一、漏洞信息
 漏洞编号：[CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046)
 漏洞归属组件：[openjdk-1.8.0](https://gitee.com/src-openeuler/openjdk-1.8.0)
 漏洞归属的版本：1.,1.8.0.292.b10,1.8.0.302.b07,1.8.0.312.b07,1.8.0.322.b06,1.8.0.332.b09,1.8.0.342.b07,1.8.0.352.b07,1.8.0.352.b08,1.8.0.362.b09
 CVSS V3.0分值：
  BaseScore：9.0 Critical
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
 漏洞简述：
  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
 漏洞公开时间：2021-12-15 03:15:07
 漏洞创建时间：2024-09-21 10:58:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-45046
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/14/4 |  |
| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/15/3 |  |
| security.apache.org | http://www.openwall.com/lists/oss-security/2021/12/18/1 |  |
| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf |  |
| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf |  |
| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf |  |
| security.apache.org | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf |  |
| security.apache.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ |  |
| security.apache.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ |  |
| security.apache.org | https://logging.apache.org/log4j/2.x/security.html |  |
| security.apache.org | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 |  |
| security.apache.org | https://security.gentoo.org/glsa/202310-16 |  |
| security.apache.org | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd |  |
| security.apache.org | https://www.cve.org/CVERecord?id=CVE-2021-44228 |  |
| security.apache.org | https://www.debian.org/security/2021/dsa-5022 |  |
| security.apache.org | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html |  |
| security.apache.org | https://www.kb.cert.org/vuls/id/930724 |  |
| security.apache.org | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |  |
| security.apache.org | https://www.oracle.com/security-alerts/cpuapr2022.html |  |
| security.apache.org | https://www.oracle.com/security-alerts/cpujan2022.html |  |
| security.apache.org | https://www.oracle.com/security-alerts/cpujul2022.html |  |
| suse_bugzilla | https://logging.apache.org/log4j/2.x/security.html | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-44228 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-45046 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |
| suse_bugzilla | http://seclists.org/oss-sec/2021/q4/159 | https://bugzilla.suse.com/show_bug.cgi?id=1193743 |
| redhat_bugzilla | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://logging.apache.org/log4j/2.x/security.html | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5148 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5106 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5141 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2021:5107 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2021-45046 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0203 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0205 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0083 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0216 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0222 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:0223 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1296 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1297 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:1299 | https://bugzilla.redhat.com/show_bug.cgi?id=2032580 |
| ubuntu | https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://issues.apache.org/jira/browse/LOG4J2-3221 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://ubuntu.com/security/notices/USN-5197-1 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-45046 | https://ubuntu.com/security/CVE-2021-45046 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2021-45046 |
| oracle |  | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |
| log4j | https://issues.apache.org/jira/browse/LOG4J2-2819 | https://logging.apache.org/log4j/2.x/security.html |
| log4j | https://issues.apache.org/jira/browse/LOG4J2-1863 | https://logging.apache.org/log4j/2.x/security.html |
| gentoo |  | https://security.gentoo.org/glsa/202310-16 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2021-45046 |
| cve_search |  | http://www.openwall.com/lists/oss-security/2021/12/14/4 |
| cve_search |  | https://logging.apache.org/log4j/2.x/security.html |
| cve_search |  | https://www.cve.org/CVERecord?id=CVE-2021-44228 |
| cve_search |  | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html |
| cve_search |  | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd |
| cve_search |  | http://www.openwall.com/lists/oss-security/2021/12/15/3 |
| cve_search |  | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf |
| cve_search |  | https://www.kb.cert.org/vuls/id/930724 |
| cve_search |  | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf |
| cve_search |  | https://www.debian.org/security/2021/dsa-5022 |
| cve_search |  | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |
| cve_search |  | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 |
| cve_search |  | http://www.openwall.com/lists/oss-security/2021/12/18/1 |
| cve_search |  | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf |
| cve_search |  | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf |
| cve_search |  | https://www.oracle.com/security-alerts/cpujan2022.html |
| cve_search |  | https://www.oracle.com/security-alerts/cpuapr2022.html |
| cve_search |  | https://www.oracle.com/security-alerts/cpujul2022.html |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ |
| cve_search |  | https://security.gentoo.org/glsa/202310-16 |
| gradle |  | https://security.gradle.com/advisory/2021-11 |
| kafka |  | https://kafka.apache.org/cve-list |
| github_advisory | https://www.cve.org/CVERecord?id=CVE-2021-44228 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.oracle.com/security-alerts/cpuapr2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.oracle.com/security-alerts/cpujan2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/15/3 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/18/1 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.oracle.com/security-alerts/cpujul2022.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://logging.apache.org/log4j/2.x/security.html | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2021-45046 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://github.com/advisories/GHSA-jfh8-c2jp-5v3q | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | http://www.openwall.com/lists/oss-security/2021/12/14/4 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.openwall.com/lists/oss-security/2021/12/14/4 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.debian.org/security/2021/dsa-5022 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |
| github_advisory | https://www.kb.cert.org/vuls/id/930724 | https://github.com/advisories/GHSA-7rjr-3q55-vv33 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | http://www.openwall.com/lists/oss-security/2021/12/14/4 |  | nvd |
|  |  | http://www.openwall.com/lists/oss-security/2021/12/15/3 |  | nvd |
|  |  | http://www.openwall.com/lists/oss-security/2021/12/18/1 |  | nvd |
|  |  | https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf |  | nvd |
|  |  | https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf |  | nvd |
|  |  | https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf |  | nvd |
|  |  | https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ |  | nvd |
|  |  | https://logging.apache.org/log4j/2.x/security.html |  | nvd |
|  |  | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 |  | nvd |
|  |  | https://security.gentoo.org/glsa/202310-16 |  | nvd |
|  |  | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd |  | nvd |
|  |  | https://www.cve.org/CVERecord?id=CVE-2021-44228 |  | nvd |
|  |  | https://www.debian.org/security/2021/dsa-5022 |  | nvd |
|  |  | https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html |  | nvd |
|  |  | https://www.kb.cert.org/vuls/id/930724 |  | nvd |
|  |  | https://www.oracle.com/security-alerts/alert-cve-2021-44228.html |  | nvd |
|  |  | https://www.oracle.com/security-alerts/cpuapr2022.html |  | nvd |
|  |  | https://www.oracle.com/security-alerts/cpujan2022.html |  | nvd |
|  |  | https://www.oracle.com/security-alerts/cpujul2022.html |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  不受影响
 openEuler评分：
  9.0
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(1.8.0.412.b08):不受影响
2.openEuler-20.03-LTS-SP4(1.8.0.412.b08):不受影响
3.openEuler-22.03-LTS-SP1(1.8.0.412.b08):不受影响
4.openEuler-22.03-LTS-SP3(1.8.0.412.b08):不受影响
5.openEuler-22.03-LTS-SP4(1.8.0.402.b06):不受影响
6.openEuler-24.03-LTS(1.8.0.412.b08):不受影响
7.openEuler-24.03-LTS-Next(1.8.0.412.b08):不受影响

修复是否涉及abi变化(是/否)：
  1.master(1.8.0.412.b08):否
2.openEuler-20.03-LTS-SP4(1.8.0.412.b08):否
3.openEuler-22.03-LTS-SP1(1.8.0.412.b08):否
4.openEuler-22.03-LTS-SP3(1.8.0.412.b08):否
5.openEuler-22.03-LTS-SP4(1.8.0.402.b06):否
6.openEuler-24.03-LTS(1.8.0.412.b08):否
7.openEuler-24.03-LTS-Next(1.8.0.412.b08):否

原因说明：
  1.master(1.8.0.412.b08):
2.openEuler-20.03-LTS-SP4(1.8.0.412.b08):
3.openEuler-22.03-LTS-SP1(1.8.0.412.b08):
4.openEuler-22.03-LTS-SP3(1.8.0.412.b08):
5.openEuler-22.03-LTS-SP4(1.8.0.402.b06):
6.openEuler-24.03-LTS(1.8.0.412.b08):
7.openEuler-24.03-LTS-Next(1.8.0.412.b08):

src-openEuler/openjdk-1.8.0
关闭

内容风险标识

评论 (5)

src-openEuler/openjdk-1.8.0关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-45046

评论 (5)

搜索帮助

src-openEuler/openjdk-1.8.0
关闭