Infinite loop in Apache Log4j - CVE-2021-45105

Vulnerability identifier: #VU59051

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-45105

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the StrSubstitutor class. A remote attacker can pass specially crafted input to the application, consume all available system resources and cause denial of service conditions.

Payload example: ${${::-${::-$${::-j}}}}

Apache Log4j
Nutanix Objects
Silver Peak Orchestrator
Dell EMC VxRail Appliance
Enhanced Interactive Unified Mediation (eIUM)
UIoT
Spectator
Authentication Server Function (AUSF)
Unified Data Management (UDM)
User Data Repository (UDR)
Unstructured Data Storage Function (UDSF)
Oracle Utilities Network Management System
PowerFlex Manager
PowerFlex Presentation Server
RecoverPoint Classic
Oracle Business Intelligence Enterprise Edition
Java agent
Oracle Communications Service Broker
IBM Maximo Scheduler Optimization
Oracle Financial Services Analytical Applications Infrastructure
Opencast
Oracle Retail Returns Management
Oracle Retail Back Office
Oracle Retail Central Office
Oracle Retail Service Backbone
Oracle Retail Order Broker
PaperCut MF
PaperCut NG
Edge Infrastructure Automation
IBM Planning Analytics Workspace
Real Time Management System (RTMS)
Dell Support Assist Enterprise
3PAR Service Processors
Trueview Inventory Software Series
Sterling Configure, Price, Quote
Fraud Risk Management (FRM)
IBM SANnav Management Portal
IBM SANnav Global View
IBM Telco Network Cloud Manager - Performance (TNCP)
SPSS Statistics Subscription
IBM Cloud Pak for Data System
QRadar User Behavior Analytics
i2 Connect
IBM Observability with Instana Infrastructure Quality Monitoring
IBM Observability with Instana Application Performance Monitoring
IBM Observability by Instana Application Performance Monitoring
IBM Observability by Instana Infrastructure Quality Monitoring
IBM PureData System for Operational Analytics
z/Transaction Processing Facility ( z/TPF)
IBM Netcool Agile Service Manager
Jazz for Service Management
IBM Cloud Application Business Insights
TPF Operations Server
Log Analysis
IBM Operations Analytics Predictive Insights
Sterling Connect Direct File Agent
Netcool Operations Insight
IBM Spectrum Protect Snapshot for VMware
IBM Spectrum Copy Data Management
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Conductor
IBM Cloud Transformation Advisor
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Security Guardium Insights
IBM SPSS Analytic Server
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Guardium Data Encryption (GDE)
IBM Tivoli System Automation Application Manager
IBM Sterling Connect:Direct for UNIX
i2 Analyze
OpenShift Logging
IBM Spectrum Scale for IBM Elastic Storage Server
IBM Sterling B2B Integrator
IBM Elastic Storage System
Nutanix AOS
IBM Sterling Connect:Direct Web Services
Red Hat Integration Camel-K
IBM Sterling Partner Engagement Manager
IBM Sterling Connect:Direct for zOS
IBM Tivoli Monitoring
IBM Tivoli Netcool Impact
IBM Spectrum Protect Operations Center
Oracle Communications WebRTC Session Controller
IBM Spectrum Symphony
StoredIQ
Oracle Financial Services Model Management and Governance
Netcool/OMNIbus
IBM Security Access Manager for Enterprise Single-Sign On
IBM Common Licensing
IBM MQ
IBM Customer and Network Analytics for Communications Service Providers and Datasets
IBM Spectrum Protect Plus
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
RSA RT
IBM Robotic Process Automation with Automation Anywhere
IBM SPSS Modeler
Dell EMC Data Protection Search
IBM SPSS Statistics Server
Operations Dashboard
IBM Decision Optimization for Cloud Pak for Data
Dell EMC Unisphere Central
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
Connectrix MDS-DCNM
EMC Data Protection Advisor
Dell NetWorker Virtual Edition
EMC NetWorker Server
API Gateway
AMQ Streams
JBoss Enterprise Application Platform
Fuse
IBM WebSphere Application Server
Oracle Retail Predictive Application Server
API Manager
IBM Integrated Analytics System
IBM Db2 Web Query for i
Cloudera Data Platform Private Cloud Base for IBM
i2 Analyst's Notebook Premium
Oracle Managed File Transfer
Oracle WebCenter Sites
Oracle Retail Price Management
data-transfer-project
IBM Data Management Platform for EDB Postgres Standard
IBM Data Management Platform for EDB Postgres Enterprise
IBM Disconnected Log Collector
IBM Spectrum Protect Snapshot for Windows
Red Hat OpenShift Container Platform
IBM Spectrum Protect Backup-Archive Client
Cloud Pak for Security (CP4S)
Event Streams
IBM Cognos Controller
IBM SPSS Statistics Desktop
Cloud Pak for Data
JBoss Data Grid
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
apache-log4j2 (Debian package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
thrift
libthrift-java
perl-thrift
python3-thrift
thrift-debugsource
thrift-devel
thrift-glib
thrift-qt
wildfly-elytron
wildfly-elytron-javadoc
eap7-yasson (Red Hat package)
wildfly-common
wildfly-common-help
wildfly-security-manager
wildfly-security-manager-javadoc
wildfly-server-provisioning-maven-plugin
wildfly-build-tools
wildfly-build-tools-javadoc
wildfly-feature-pack-build-maven-plugin
wildfly-server-provisioning
wildfly-server-provisioning-standalone
eap7-xom (Red Hat package)
avalon-logkit
avalon-logkit-help
wildfly-core-feature-pack
wildfly-core-javadoc
wildfly-core
eap7-wildfly-openssl (Red Hat package)
HikariCP-help
HikariCP
jenkins-json-lib
json-lib
json-lib-help
liblog4j2-java (Ubuntu package)
eap7-activemq-artemis (Red Hat package)
log4j-bom
log4j-jcl
log4j
log4j-jmx-gui
log4j-help
log4j-web
log4j-slf4j
log4j-taglib
eap7-log4j (Red Hat package)
mx4j-manual
mx4j-javadoc
mx4j
metrics-javadoc
metrics-annotation
metrics-healthchecks
metrics-httpasyncclient
metrics-jvm
metrics-log4j
metrics-httpclient
metrics-servlets
metrics-log4j2
metrics-jdbi
metrics-jersey2
metrics-logback
metrics-parent
metrics-json
metrics-servlet
metrics-graphite
metrics-ganglia
metrics-ehcache
metrics-doc
metrics-benchmarks
metrics
datanucleus-api-jdo-javadoc
mybatis
datanucleus-api-jdo
mybatis-javadoc
datanucleus-rdbms-javadoc
datanucleus-rdbms
datanucleus-core
datanucleus-core-javadoc
eap7-jboss-vfs (Red Hat package)
springframework-expression
springframework
springframework-aop
springframework-beans
springframework-context
springframework-help
springframework-instrument
springframework-jdbc
springframework-orm
springframework-orm-hibernate4
springframework-oxm
springframework-tx
springframework-web
springframework-jms
jboss-logging-javadoc
jboss-logging
eap7-hal-console (Red Hat package)
jgroups
jgroups-help
eap7-ecj (Red Hat package)
netty
netty-help
avalon-framework
avalon-framework-help
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
infinispan
infinispan-help
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
EMC Integrated Data Protection Appliance
IBM Security SOAR
Zoho ManageEngine EventLog Analyzer
Apache Struts
IBM Analytic Accelerator Framework for Communication Service Providers
IBM TRIRIGA Application Platform
IBM TRIRIGA
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Spectrum Scale
Deep Discovery Director
Ghidra
SecureTransport
IBM Sterling File Gateway
Dell Storage Manager
Oracle Communications Services Gatekeeper
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
IBM Security Guardium
IBM Spectrum Protect for Space Management
Red Hat Single Sign-On
IBM Cognos Analytics
Planning Analytics Local
IBM DB2
Oracle WebCenter Portal
Instantis EnterpriseTrack
Oracle Retail Point of Service
Oracle Retail Invoice Matching
Oracle Retail EFTLink
Oracle Retail Order Management System
Oracle Retail Integration Bus
Ubuntu
openEuler
Fedora
IntroSpect
HPE StoreServ Management Console
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
vCenter Server Appliance
Informix Dynamic Server
IBM DS8000 Hardware Management Console

Install updates from vendor's website.

Apache Log4j - update to 2.17.0
API Gateway - update to February 2022
API Manager - update to February 2022
data-transfer-project - update to 0.3.63
IBM Cloud Pak for Data System - addressed in versions 1.0.7.8, 2.0.1.1
QRadar User Behavior Analytics - update to 4.1.6
IBM Integrated Analytics System - update to 1.0.26.3
Spectator - update to 1.0.11
IBM Netcool Agile Service Manager - update to 1.1.10
Jazz for Service Management - update to 1.1.3.13
Log Analysis - update to 1.3.7.2
AMQ Streams - update to 1.6.6
IBM Disconnected Log Collector - update to 1.7.2
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-15.Final_redhat_00014.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.11-1.Final_redhat_00002.1.el7eap, 1.15.11-1.Final_redhat_00002.1.el8eap
Authentication Server Function (AUSF) - addressed in versions 1.2109.1, 1.2112.0
Unified Data Management (UDM) - addressed in versions 1.2109.2, 1.2112.0
User Data Repository (UDR) - update to 1.2112.0
Unstructured Data Storage Function (UDSF) - update to 1.2112.0
apache-log4j2 (Debian package) - addressed in versions 2.17.0-1~deb10u1, 2.17.0-1~deb11u1
eap7-undertow (Red Hat package) - addressed in versions 2.2.16-1.Final_redhat_00001.1.el7eap, 2.2.16-1.Final_redhat_00001.1.el8eap
IBM Spectrum Copy Data Management - update to 2.2.14.2
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fixpack 4
EMC Integrated Data Protection Appliance - update to 2.7.3
Apache Struts - update to 2.5.28.2
IBM Security Guardium Key Lifecycle Manager (GKLM) - addressed in versions 4.1 FP3, 4.1.1 FP3
PowerFlex Manager - update to 3.8.0-8187
PowerFlex Presentation Server - addressed in versions 3.5.1.5, 3.6.0.3
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.6-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el8eap
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.5
IBM Analytic Accelerator Framework for Communication Service Providers - update to 4.0.0.2
IBM Spectrum Protect Snapshot for Windows - addressed in versions 7.1.8.14, 8.1.13.2
Dell EMC Storage Monitoring and Reporting (SMR) - addressed in versions 4.5.0.2, 4.6.0.2
Red Hat OpenShift Container Platform - update to 4.6.53
OpenShift Logging - addressed in versions 5.0.11, 5.1.6, 5.2.5, 5.3.2
RecoverPoint Classic - update to 5.1 SP4 P4
Deep Discovery Director - update to 5.3 CP B1225
eap7-hibernate (Red Hat package) - addressed in versions 5.3.25-1.Final_redhat_00002.1.el7eap, 5.3.25-1.Final_redhat_00002.1.el8eap
SecureTransport - update to 5.5-20220127
Java agent - addressed in versions 6.5.3, 7.4.3, 7.5.0
Red Hat Integration Camel-K - update to 6.1.3
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.3.4, 6.2.0.1.3
IBM Spectrum Protect Operations Center - addressed in versions 7.1.14.200, 8.1.13.200
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware - addressed in versions 7.1.8.14, 8.1.13.2
IBM Spectrum Protect Backup-Archive Client - addressed in versions 7.1.8.14, 8.1.13.2
IBM Spectrum Protect for Space Management - addressed in versions 7.1.8.14, 8.1.13.2
JBoss Enterprise Application Platform - update to 7.4.4
eap7-wildfly (Red Hat package) - addressed in versions 7.4.4-3.GA_redhat_00011.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el8eap
Red Hat Single Sign-On - update to 7.5.2
StoredIQ - update to siq_7_6_0_22_log4j_2_17_1_
Fuse - addressed in versions 7.8.2, 7.9.1, 7.10.1
IBM Maximo Scheduler Optimization - update to 8.0.3
Netcool/OMNIbus - update to 8.1.0.28
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.13.2
Opencast - addressed in versions 9.12, 10.8, 11.2
IBM Customer and Network Analytics for Communications Service Providers and Datasets - update to 10.0.0.2
Ghidra - update to 10.1.1
IBM Spectrum Protect Plus - update to 10.1.9.2
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.9.2
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.9.2
IBM Cognos Analytics - addressed in versions 11.0.13.5, 11.1.7.8, 11.2.1.3
IBM DB2 - addressed in versions 11.5.6.0, 11.5.7.0
Oracle Retail Service Backbone - update to 16.0.3.0
Oracle Retail Integration Bus - update to 16.0.3.0
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.6-1.redhat_00001.1.el7sso, 15.0.6-1.redhat_00001.1.el8sso
Dell EMC Data Protection Search - addressed in versions 19.6.1, 19.6.2
PaperCut MF - update to 21.2.4
PaperCut NG - update to 21.2.4
IBM Security SOAR - addressed in versions 42.2.41, 43.0.7662
Zoho ManageEngine EventLog Analyzer - update to 12214
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el8eap
thrift - update to 0.14.0-5
libthrift-java - update to 0.14.0-5
perl-thrift - update to 0.14.0-5
python3-thrift - update to 0.14.0-5
thrift-debugsource - update to 0.14.0-5
thrift-devel - update to 0.14.0-5
thrift-glib - update to 0.14.0-5
thrift-qt - update to 0.14.0-5
wildfly-elytron - update to 1.0.2-2
wildfly-elytron-javadoc - update to 1.0.2-2
eap7-yasson (Red Hat package) - addressed in versions 1.0.10-1.redhat_00001.1.el7eap, 1.0.10-1.redhat_00001.1.el8eap
wildfly-common - update to 1.1.0-8
wildfly-common-help - update to 1.1.0-8
wildfly-security-manager - update to 1.1.2-2
wildfly-security-manager-javadoc - update to 1.1.2-2
wildfly-server-provisioning-maven-plugin - update to 1.1.6-2
wildfly-build-tools - update to 1.1.6-2
wildfly-build-tools-javadoc - update to 1.1.6-2
wildfly-feature-pack-build-maven-plugin - update to 1.1.6-2
wildfly-server-provisioning - update to 1.1.6-2
wildfly-server-provisioning-standalone - update to 1.1.6-2
eap7-xom (Red Hat package) - addressed in versions 1.3.7-1.redhat_00001.1.el7eap, 1.3.7-1.redhat_00001.1.el8eap
Edge Infrastructure Automation - update to 2.0.6.1
Planning Analytics Local - update to 2.0.9.11
IBM Planning Analytics Workspace - update to 2.0.72
avalon-logkit - update to 2.1-34
avalon-logkit-help - update to 2.1-34
wildfly-core-feature-pack - update to 2.2.0-3
wildfly-core-javadoc - update to 2.2.0-3
wildfly-core - update to 2.2.0-3
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.0-3.Final_redhat_00002.1.el7eap, 2.2.0-3.Final_redhat_00002.1.el8eap
HikariCP-help - update to 2.4.3-6
HikariCP - update to 2.4.3-6
jenkins-json-lib - update to 2.4-19
json-lib - update to 2.4-19
json-lib-help - update to 2.4-19
IntroSpect - update to 2.5.0.7
liblog4j2-java (Ubuntu package) - addressed in versions 2.12.4-0ubuntu0.1, 2.17.0-0.20.04.1, 2.17.0-0.21.04.1, 2.17.0-0.21.10.1, 2.17.1-0.20.04.1, 2.17.1-0.21.04.1, 2.17.1-0.21.10.1
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-7.redhat_00034.1.el7eap, 2.16.0-7.redhat_00034.1.el8eap
log4j-bom - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-jcl - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-jmx-gui - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-help - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-web - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-slf4j - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j-taglib - addressed in versions 2.17.0-1, 2.17.0-3, 2.17.0-4
log4j - addressed in versions 2.17.0-1.fc34, 2.17.0-1.fc35
eap7-log4j (Red Hat package) - addressed in versions 2.17.1-1.redhat_00001.1.el7eap, 2.17.1-1.redhat_00001.1.el8eap
mx4j-manual - update to 3.0.1-3
mx4j-javadoc - update to 3.0.1-3
mx4j - update to 3.0.1-3
Real Time Management System (RTMS) - update to 3.00.72.1
metrics-javadoc - update to 3.1.2-3
metrics-annotation - update to 3.1.2-3
metrics-healthchecks - update to 3.1.2-3
metrics-httpasyncclient - update to 3.1.2-3
metrics-jvm - update to 3.1.2-3
metrics-log4j - update to 3.1.2-3
metrics-httpclient - update to 3.1.2-3
metrics-servlets - update to 3.1.2-3
metrics-log4j2 - update to 3.1.2-3
metrics-jdbi - update to 3.1.2-3
metrics-jersey2 - update to 3.1.2-3
metrics-logback - update to 3.1.2-3
metrics-parent - update to 3.1.2-3
metrics-json - update to 3.1.2-3
metrics-servlet - update to 3.1.2-3
metrics-graphite - update to 3.1.2-3
metrics-ganglia - update to 3.1.2-3
metrics-ehcache - update to 3.1.2-3
metrics-doc - update to 3.1.2-3
metrics-benchmarks - update to 3.1.2-3
metrics - update to 3.1.2-3
datanucleus-api-jdo-javadoc - update to 3.2.8-3
mybatis - update to 3.2.8-3
datanucleus-api-jdo - addressed in versions 3.2.8-3, 3.2.15-3
mybatis-javadoc - update to 3.2.8-3
datanucleus-rdbms-javadoc - update to 3.2.13-4
datanucleus-rdbms - update to 3.2.13-4
datanucleus-core - update to 3.2.15-3
datanucleus-core-javadoc - update to 3.2.15-3
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.16-1.Final_redhat_00001.1.el7eap, 3.2.16-1.Final_redhat_00001.1.el8eap
springframework-expression - update to 3.2.18-10
springframework - update to 3.2.18-10
springframework-aop - update to 3.2.18-10
springframework-beans - update to 3.2.18-10
springframework-context - update to 3.2.18-10
springframework-help - update to 3.2.18-10
springframework-instrument - update to 3.2.18-10
springframework-jdbc - update to 3.2.18-10
springframework-orm - update to 3.2.18-10
springframework-orm-hibernate4 - update to 3.2.18-10
springframework-oxm - update to 3.2.18-10
springframework-tx - update to 3.2.18-10
springframework-web - update to 3.2.18-10
springframework-jms - update to 3.2.18-10
jboss-logging-javadoc - update to 3.3.0-7
jboss-logging - update to 3.3.0-7
eap7-hal-console (Red Hat package) - addressed in versions 3.3.9-1.Final_redhat_00001.1.el7eap, 3.3.9-1.Final_redhat_00001.1.el8eap
Cloud Pak for Data - addressed in versions 3.5.10, 4.0.5
IBM Decision Optimization for Cloud Pak for Data - addressed in versions 3.5.11, 4.0.5
jgroups - update to 3.6.10-8
jgroups-help - update to 3.6.10-8
HPE StoreServ Management Console - update to 3.8.2.1
eap7-ecj (Red Hat package) - addressed in versions 3.26.0-1.redhat_00002.1.el7eap, 3.26.0-1.redhat_00002.1.el8eap
Dell EMC Unisphere Central - update to 4.0.9.1541235
netty - addressed in versions 4.1.13-14, 4.1.13-15
netty-help - update to 4.1.13-15
avalon-framework - update to 4.3-24
avalon-framework-help - update to 4.3-24
Dell EMC VxRail Appliance - update to 4.5.471
Dell Support Assist Enterprise - update to 5.00.06
3PAR Service Processors - update to 5.0.9.2
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.4-1.Final_redhat_00001.1.el7eap, 5.4.4-1.Final_redhat_00001.1.el8eap
eap7-narayana (Red Hat package) - addressed in versions 5.11.4-1.Final_redhat_00001.1.el7eap, 5.11.4-1.Final_redhat_00001.1.el8eap
vCenter Server Appliance - addressed in versions 6.5 U3s, 6.7 U3q, 7.0 U3c
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
JBoss Data Grid - update to 8.2.3
infinispan - update to 8.2.4-10
infinispan-help - update to 8.2.4-10
IBM Maximo Application Suite - addressed in versions 8.6.3, 8.7.1
Trueview Inventory Software Series - addressed in versions 8.6.22.1, 8.7.3
eap7-objectweb-asm (Red Hat package) - addressed in versions 9.1.0-1.redhat_00002.1.el7eap, 9.1.0-1.redhat_00002.1.el8eap
Sterling Configure, Price, Quote - update to 10.0.0.24
eap7-infinispan (Red Hat package) - addressed in versions 11.0.15-1.Final_redhat_00001.1.el7eap, 11.0.15-1.Final_redhat_00001.1.el8eap
Connectrix MDS-DCNM - addressed in versions 11.5(4), 12.1.1e
Informix Dynamic Server - addressed in versions 12.10.FC15W1, 14.10.FC7W1
Fraud Risk Management (FRM) - addressed in versions 14.0.2 Revision 10, 14.1 Revision 3
EMC Data Protection Advisor - addressed in versions 19.4 B104, 19.5 B74, 19.6 B24
Dell NetWorker Virtual Edition - addressed in versions 19.4.0.6, 19.5.0.5, 19.6.0
EMC NetWorker Server - addressed in versions 19.4.0.6, 19.5.0.5, 19.6.0
Dell Storage Manager - update to 20.1.2
IBM DS8000 Hardware Management Console - addressed in versions 88.50.184.0, 89.12.8.0

• Exploit #7204 - log4j2_dos_exploit (log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc) (December 26, 2021)
• Exploit #7192 - CVE-2021-45105 (Replicating CVE-2021-45105) (December 20, 2021)
• Exploit #7187 - Log4j_dos_CVE-2021-45105 (Log4j_dos_CVE-2021-45105) (December 19, 2021)

• https://issues.apache.org/jira/browse/LOG4J2-3230
• https://logging.apache.org/log4j/2.x/security.html
• https://www.zerodayinitiative.com/advisories/ZDI-21-1541/

• Infinite recursion in Apache Log4j
• opencast update for Apache Log4J
• Debian update for apache-log4j2
• Netflix Spectator update for Apache Log4j
• Multiple Vulnerabilities PaperCut MF
• Multiple Vulnerabilities PaperCut NG
• Ghidra update for Apache Log4j
• Multiple Vulnerabilities in Java agent
• Multiple vulnerabilities in IBM SPSS Analytic Server
• Multiple vulnerabilities in Trend Micro Deep Discovery Director (Apache Log4j component)
• Multiple vulnerabilities in IBM Cloud Application Business Insights
• Multiple vulnerabilities in Sterling Connect Direct File Agent
• Zoho ManageEngine EventLog Analyzer update for Apache Log4j
• Multiple vulnerabilities in IBM Jazz for Service Management (Apache Log4j component)
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM SPSS Statistics Desktop
• Multiple vulnerabilities in IBM SPSS Statistics Server
• Multiple vulnerabilities in SPSS Statistics Subscription
• Multiple vulnerabilities in IBM DB2 (Apache Log4j component)
• Multiple vulnerabilities in IBM SPSS Modeler
• Multiple vulnerabilities in IBM Spectrum Protect Operations Center (Apache Log4j component)
• Multiple vulnerabilities in IBM SANnav
• Multiple vulnerabilities in IBM SPSS Statistics
• Multiple vulnerabilities in Dell EMC Unity (Apache Log4j component)
• Denial of service in IBM Db2 Web Query for i
• Multiple vulnerabilities in IBM Guardium Data Encryption (GDE)
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in Nutanix AOS
• Multiple vulnerabilities in Nutanix Objects
• Multiple vulnerabilities in IBM Sterling File Gateway
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Elastic Storage System (Apache Log4j component)
• Multiple vulnerabilities in IBM Spectrum Scale
• Multiple vulnerabilities in IBM Spectrum Scale for IBM Elastic Storage Server
• Multiple vulnerabilities in IBM i2 Analyze, i2 Analyst's Notebook Premium and IBM i2 Connect
• Dell EMC Unisphere Central update for Apache Log4j
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container Backup and Restore
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• IBM WebSphere Application Server update for Apache Log4j
• Denial of service in Apache Struts Log4j library
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager
• Multiple vulnerabilities in IBM Spectrum Protect for Space Management
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager
• Multiple vulnerabilities in IBM Sterling Connect:Direct for z/OS
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in OpenShift Logging
• Multiple vulnerabilities in IBM Spectrum Protect Snapshot for Windows
• Multiple vulnerabilities in IBM Spectrum Protect Snapshot for VMware
• Multiple vulnerabilities in IBM Security SOAR
• Multiple vulnerabilities in IBM Spectrum Protect Backup-Archive Client
• Multiple vulnerabilities in IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
• Multiple vulnerabilities in IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
• z/Transaction Processing Facility (z/TPF) update for Apache Log4j
• IBM TPF Operations Server update for Apache Log4j
• newrelic-java-agent update for Apache Log4j
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager (GKLM)
• Multiple vulnerabilities in IBM Spectrum Symphony
• Infinite loop in QRadar User Behavior Analytics
• Denial of service in IBM Operations Dashboard
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM MQ
• Red Hat OpenShift Container Platform update for Apache Log4j
• Infinite loop in Oracle WebCenter Portal
• Infinite loop in Oracle Managed File Transfer
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in IBM Telco Network Cloud Manager - Performance (TNCP)
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Security Access Manager for Enterprise Single-Sign On
• Multiple vulnerabilities in IBM Robotic Process Automation with Automation Anywhere
• Multiple vulnerabilities in Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in RSA RT
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Instantis EnterpriseTrack
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integrated Analytics System
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Spectrum Conductor
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in IBM Netcool Agile Service Manager
• Multiple vulnerabilities in IBM Security Guardium Insights
• Multiple vulnerabilities in IBM Observability with Instana Infrastructure Quality Monitoring
• Multiple vulnerabilities in IBM Observability with Instana Application Performance Monitoring
• Multiple vulnerabilities in IBM Observability by Instana Infrastructure Quality Monitoring
• Multiple vulnerabilities in IBM Observability by Instana Application Performance Monitoring
• Infinite loop in Oracle Communications WebRTC Session Controller
• Infinite loop in Oracle Communications Service Broker
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Infinite loop in Oracle Retail Invoice Matching
• Infinite loop in Oracle Retail EFTLink
• Multiple vulnerabilities in Oracle Retail Returns Management
• Multiple vulnerabilities in Oracle Retail Price Management
• Multiple vulnerabilities in Oracle Retail Predictive Application Server
• Multiple vulnerabilities in Oracle Retail Point-of-Service
• Multiple vulnerabilities in Oracle Retail Order Management System
• Multiple vulnerabilities in Oracle Retail Central Office
• Multiple vulnerabilities in Oracle Retail Back Office
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus
• Multiple vulnerabilities in IBM Data Management Platform for EDB Postgres Enterprise
• Multiple vulnerabilities in IBM Data Management Platform for EDB Postgres Standard
• Denial of service in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Infinite loop in data-transfer-project
• Multiple vulnerabilities in IBM TRIRIGA
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base for IBM
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• JBoss Enterprise Application Platform 7.4 for RHEL 8 update for log4j
• JBoss Enterprise Application Platform 7.4 for RHEL 7 update for log4j
• Denial of service in Red Hat Single Sign-On 7.5 on RHEL 7
• Denial of service in Red Hat Single Sign-On 7.5 on RHEL 8
• Denial of service in Red Hat Single Sign-On 7.5
• Multiple vulnerabilities in IBM Informix Dynamic Server
• Multiple vulnerabilities in IBM PureData System for Operational Analytics
• Multiple vulnerabilities in IBM DS8000 Hardware Management Console
• Denial of service in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics for Communications Service Providers and Datasets
• Ubuntu update for apache-log4j2
• Ubuntu update for apache-log4j2
• Multiple Vulnerabilities in IBM StoredIQ
• Multiple vulnerabilities in IBM Maximo Scheduler Optimization
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Dell Data Protection Search
• Multiple vulnerabilities in Dell EMC Support Assist Enterprise
• Multiple vulnerabilities in Dell EMC VxRail
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Dell Connectrix MDS-DCNM
• Multiple vulnerabilities in Dell NetWorker
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in Dell Data Protection Search
• Multiple vulnerabilities in Storage Center-Dell Storage Manager
• Multiple vulnerabilities in HPE Universal IoT (UIoT) Log4j
• Multiple vulnerabilities in HPE Network Functions
• Multiple vulnerabilities in HPE Fraud Risk Management Software Series
• Multiple vulnerabilities in HPE 3PAR Service Processors
• Multiple vulnerabilities in HPE Trueview Inventory Software Series
• Multiple vulnerabilities in HPE enhanced Interactive Unified Mediation (eIUM)
• Multiple vulnerabilities in HPE Edge Infrastructure Automation
• Multiple vulnerabilities in API Gateway and API Manager
• Axway SecureTransport update for Apache Log4j and OpenJDK JRE (January 2022)
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Application Performance Management products
• openEuler update for log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanu
• openEuler 20.03 LTS SP1 update for log4j
• openEuler 20.03 LTS SP3 update for log4j
• Multiple vulnerabilities in IBM Sterling Configure, Price, Quote
• Multiple vulnerabilities in IBM Planning Analytics and IBM Planning Analytics Workspace
• Multiple vulnerabilities in JBoss Data Grid 8.2
• Fedora 35 update for log4j
• Fedora 34 update for log4j
• Multiple vulnerabilities in HPE Real Time Management System (RTMS)
• Multiple vulnerabilities in HPE 3PAR/Primera StoreServ Management Console (SSMC)
• Multiple vulnerabilities in HPE Aruba Silver Peak Orchestrator and Aruba IntroSpect
• Dell EMC Storage Monitoring and Reporting (SMR) update for Apache Log4j
• Dell Data Protection Advisor update for Apache Log4j
• Multiple vulnerabilities in Oracle WebCenter Sites