[Bug 2034067] New: CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Bug ID: 2034067
           Summary: CVE-2021-45105 log4j-core: DoS in log4j 2.x with
                    Thread Context Map (MDC) input data contains a
                    recursive lookup and context lookup pattern
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]
            Blocks: 2030930
  Target Milestone: ---
    Classification: Other

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from
uncontrolled recursion from self-referential lookups. When the logging
configuration uses a non-default Pattern Layout with a Context Lookup (for
example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC)
input data can craft malicious input data that contains a recursive lookup,
resulting in a StackOverflowError that will terminate the process. This is also
known as a DOS (Denial of Service) attack.

This issue is being tracked as LOG4J2-3230

Mitigation:

Implement one of the following mitigation techniques:

* Java 8 (or later) users should upgrade to release 2.17.0.

Alternatively, this can be mitigated in configuration:

* In PatternLayout in the logging configuration, replace Context Lookups like
${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc,
or %MDC).
* Otherwise, in the configuration, remove references to Context Lookups like
${ctx:loginId} or $${ctx:loginId} where they originate from sources external to
the application such as HTTP headers or user input.

Note that only the log4j-core JAR file is impacted by this vulnerability.
Applications using only the log4j-api JAR file without the log4j-core JAR file
are not impacted by this vulnerability.

Reference:
https://logging.apache.org/log4j/2.x/security.html
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://issues.apache.org/jira/browse/LOG4J2-3230

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Huzaifa S. Sidhpurwala  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2034082

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2034082
[Bug 2034082] CVE-2021-45105 log4j: log4j-core: DoS in log4j 2.x with Thread
Context Map (MDC) input data contains a recursive lookup and context lookup
pattern [fedora-all]

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #1 from Huzaifa S. Sidhpurwala  ---
Created log4j tracking bugs for this issue:

Affects: fedora-all [bug 2034082]

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #2 from Huzaifa S. Sidhpurwala  ---
Upstream patch:
https://github.com/apache/logging-log4j2/commit/806023265f8c905b2dd1d81fd245...

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2034083, 2034084

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2034091, 2034089, 2034090

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Doc Text *updated* by Paramvir jindal  ---
A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Florencio Cano  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2034148

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Florencio Cano  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #16 from Yadnyawalk Tale  ---
Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is
not affected as it uses logback framework for logging.

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Bin Hu  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #17 from Bin Hu  ---
will JWS 3.x/5.x and Apache httpd also get affected?

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #18 from Bin Hu  ---
Is AMQ broker 7.x get affected?

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2030985

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #19 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-45105

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2021-12-22 00:20:31

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #20 from Ted Jongseok Won  ---
In reply to comment #17:
> will JWS 3.x/5.x and Apache httpd also get affected?

They are not affected.

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Mithilesh Kaur Bagga  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail],
                   |                            |security-response-team@redh
                   |                            |at.com
              Flags|                            |needinfo?(security-response
                   |                            |[e-mail])

--- Comment #21 from Mithilesh Kaur Bagga  ---
Hello Team,

Is this https://access.redhat.com/security/cve/cve-2021-45105 fixed in
Openshift 3.11.570?

Looking for RHSA but the CVE page didn't update:
https://access.redhat.com/security/cve/cve-2021-45105

Please help with the same.

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(security-response |needinfo?([e-mail])
                   |[e-mail])           |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Yasuhiro Ozone  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(security-response
                   |                            |[e-mail])

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(security-response |needinfo?([e-mail])
                   |[e-mail])           |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail])  |
                   |needinfo?([e-mail])  |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|log4j 2.17.0                |log4j 2.17.0, log4j 2.12.3,
                   |                            |log4j 2.3.1

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Yasuhiro Ozone  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(security-response
                   |                            |[e-mail])

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(security-response |needinfo?([e-mail])
                   |[e-mail])           |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
              Flags|needinfo?([e-mail])  |needinfo?([e-mail])

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Yadnyawalk Tale  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail]) |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Rahul Rajendran  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
              Flags|                            |needinfo?(security-response
                   |                            |[e-mail])

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(security-response |needinfo?([e-mail])
                   |[e-mail])           |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Ted Jongseok Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
              Flags|needinfo?([e-mail])  |needinfo?([e-mail])

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

Hardik Vyas  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail]) |

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #35 from errata-xmlrpc  ---
This issue has been addressed in the following products:

OpenShift Logging 5.1

Via RHSA-2022:0042 https://access.redhat.com/errata/RHSA-2022:0042

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0042

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #36 from errata-xmlrpc  ---
This issue has been addressed in the following products:

OpenShift Logging 5.2

Via RHSA-2022:0043 https://access.redhat.com/errata/RHSA-2022:0043

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0043

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #37 from errata-xmlrpc  ---
This issue has been addressed in the following products:

OpenShift Logging 5.3

Via RHSA-2022:0044 https://access.redhat.com/errata/RHSA-2022:0044

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0044

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #38 from errata-xmlrpc  ---
This issue has been addressed in the following products:

OpenShift Logging 5.0

Via RHSA-2022:0047 https://access.redhat.com/errata/RHSA-2022:0047

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0047

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #39 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat OpenShift Container Platform 4.6

Via RHSA-2022:0026 https://access.redhat.com/errata/RHSA-2022:0026

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0026

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #40 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Fuse 7.8.2
  7.9.1
  7.10.1

Via RHSA-2022:0203 https://access.redhat.com/errata/RHSA-2022:0203

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0203

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #41 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Data Grid 8.2.3

Via RHSA-2022:0205 https://access.redhat.com/errata/RHSA-2022:0205

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0205

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #42 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Vert.x 4.1.8

Via RHSA-2022:0083 https://access.redhat.com/errata/RHSA-2022:0083

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0083

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #43 from errata-xmlrpc  ---
This issue has been addressed in the following products:

EAP 7.4 log4j async

Via RHSA-2022:0216 https://access.redhat.com/errata/RHSA-2022:0216

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0216

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #44 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat AMQ Streams 1.6.6

Via RHSA-2022:0219 https://access.redhat.com/errata/RHSA-2022:0219

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0219

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #45 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration Camel Extensions for Quarkus 2.2

Via RHSA-2022:0222 https://access.redhat.com/errata/RHSA-2022:0222

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0222

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #46 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration Camel-K 1.6.3

Via RHSA-2022:0223 https://access.redhat.com/errata/RHSA-2022:0223

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:0223

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #47 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:1296 https://access.redhat.com/errata/RHSA-2022:1296

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1296

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #48 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:1297 https://access.redhat.com/errata/RHSA-2022:1297

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1297

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #49 from errata-xmlrpc  ---
This issue has been addressed in the following products:

EAP 7.4.4 release

Via RHSA-2022:1299 https://access.redhat.com/errata/RHSA-2022:1299

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1299

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #50 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Single Sign-On

Via RHSA-2022:1469 https://access.redhat.com/errata/RHSA-2022:1469

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1469

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #51 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Single Sign-On 7.5 for RHEL 7

Via RHSA-2022:1462 https://access.redhat.com/errata/RHSA-2022:1462

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1462

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

--- Comment #52 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Single Sign-On 7.5 for RHEL 8

Via RHSA-2022:1463 https://access.redhat.com/errata/RHSA-2022:1463

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2022:1463

[Bug 2034067] CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

https://bugzilla.redhat.com/show_bug.cgi?id=2034067
Bug 2034067 depends on bug 2034082, which changed state.

Bug 2034082 Summary: CVE-2021-45105 log4j: log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2034082

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL