[OFBIZ-12470] [SECURITY] CVE-2021-45105: Apache Log4j2

• Type: Sub-task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 18.12.03
• Fix Version/s: 18.12.04
• Component/s: ALL COMPONENTS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 19/Dec/21 02:20
• Updated: 06/Jan/22 13:19
• Resolved: 19/Dec/21 09:51

Description

CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 does not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue is fixed in Log4j 2.17.0.: https://logging.apache.org/log4j/2.x/security.html

Issue Links

• is a clone of: OFBIZ-12449 [SECURITY] CVE-2021-44228: Apache Log4j2