Medium · published December 18, 2021
CVSS calls it medium at 5.9. It sits in the 100.0th percentile for exploit probability.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
| Product | Versions | Fixed in |
|---|---|---|
| apache/log4j | ≥ 2.0, < 2.3.1 | 2.3.1 |
| apache/log4j | ≥ 2.4, < 2.12.3 | 2.12.3 |
| apache/log4j | ≥ 2.13.0, ≤ 2.16.0 | — |
| netapp/cloud_manager | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| sonicwall/email_security | ≤ 10.0.12 | — |
| sonicwall/network_security_manager | ≥ 2.0, < 3.0 | 3.0 |
| sonicwall/network_security_manager | ≥ 2.0, < 3.0 | 3.0 |
| sonicwall/web_application_firewall | ≥ 3.0.0, < 3.1.0 | 3.1.0 |
| sonicwall/6bk1602-0aa12-0tp0_firmware | < 2.7.0 | 2.7.0 |
| sonicwall/6bk1602-0aa22-0tp0_firmware | < 2.7.0 | 2.7.0 |
| sonicwall/6bk1602-0aa32-0tp0_firmware | < 2.7.0 | 2.7.0 |
| sonicwall/6bk1602-0aa42-0tp0_firmware | < 2.7.0 | 2.7.0 |
| sonicwall/6bk1602-0aa52-0tp0_firmware | < 2.7.0 | 2.7.0 |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/agile_plm_mcad_connector | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/autovue_for_agile_product_lifecycle_management | all versions | — |
| oracle/banking_deposits_and_lines_of_credit_servicing | all versions | — |
| oracle/banking_enterprise_default_management | all versions | — |
| oracle/banking_enterprise_default_management | all versions | — |
| oracle/banking_loans_servicing | all versions | — |
| oracle/banking_party_management | all versions | — |
| oracle/banking_payments | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_trade_finance | all versions | — |
| oracle/banking_treasury_management | all versions | — |
| oracle/business_intelligence | all versions | — |
| oracle/communications_asap | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_cloud_native_core_console | all versions | — |
| oracle/communications_cloud_native_core_network_function_cloud_native_environment | all versions | — |
| oracle/communications_cloud_native_core_network_repository_function | all versions | — |
| oracle/communications_cloud_native_core_network_repository_function | all versions | — |
| oracle/communications_cloud_native_core_network_slice_selection_function | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_cloud_native_core_security_edge_protection_proxy | all versions | — |
| oracle/communications_cloud_native_core_service_communication_proxy | all versions | — |
| oracle/communications_cloud_native_core_unified_data_repository | all versions | — |
| oracle/communications_convergence | all versions | — |
| oracle/communications_convergence | all versions | — |
| oracle/communications_convergent_charging_controller | ≥ 12.0.1.0.0, ≤ 12.0.4.0.0 | — |
| oracle/communications_convergent_charging_controller | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.3.0.0, ≤ 8.5.1.0 | — |
| oracle/communications_eagle_element_management_system | all versions | — |
| oracle/communications_eagle_ftp_table_base_retrieval | all versions | — |
| oracle/communications_element_manager | < 9.0 | 9.0 |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_ip_service_activator | all versions | — |
| oracle/communications_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.1.0.0, ≤ 12.0.4.0.0 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/communications_network_integrity | all versions | — |
| oracle/communications_performance_intelligence_center | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_service_broker | all versions | — |
| oracle/communications_services_gatekeeper | all versions | — |
| oracle/communications_session_report_manager | < 9.0 | 9.0 |
| oracle/communications_session_route_manager | < 9.0 | 9.0 |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_user_data_repository | all versions | — |
| oracle/communications_webrtc_session_controller | all versions | — |
| oracle/communications_webrtc_session_controller | all versions | — |
| oracle/data_integrator | all versions | — |
| oracle/data_integrator | all versions | — |
| oracle/e-business_suite | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_for_peoplesoft | all versions | — |
| oracle/enterprise_manager_for_peoplesoft | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.7, ≤ 8.1.1 | — |
| oracle/financial_services_model_management_and_governance | all versions | — |
| oracle/financial_services_model_management_and_governance | all versions | — |
| oracle/financial_services_model_management_and_governance | all versions | — |
| oracle/flexcube_universal_banking | ≥ 12.1.0, ≤ 12.4 | — |
| oracle/flexcube_universal_banking | ≥ 14.0.0, ≤ 14.3.0 | — |
| oracle/flexcube_universal_banking | all versions | — |
| oracle/flexcube_universal_banking | all versions | — |
| oracle/health_sciences_empirica_signal | all versions | — |
| oracle/health_sciences_empirica_signal | all versions | — |
| oracle/health_sciences_inform | all versions | — |
| oracle/health_sciences_inform | all versions | — |
| oracle/health_sciences_inform | all versions | — |
| oracle/health_sciences_information_manager | ≥ 3.0.1, ≤ 3.0.4 | — |
| oracle/healthcare_data_repository | all versions | — |
| oracle/healthcare_foundation | ≥ 7.3.0.1, ≤ 7.3.0.4 | — |
| oracle/healthcare_master_person_index | all versions | — |
| oracle/healthcare_translational_research | all versions | — |
| oracle/healthcare_translational_research | all versions | — |
| oracle/hospitality_suite8 | all versions | — |
| oracle/hospitality_suite8 | all versions | — |
| oracle/hospitality_token_proxy_service | all versions | — |
| oracle/hyperion_bi\+ | < 11.2.8.0 | 11.2.8.0 |
| oracle/hyperion_data_relationship_management | < 11.2.8.0 | 11.2.8.0 |
| oracle/hyperion_infrastructure_technology | < 11.2.8.0 | 11.2.8.0 |
| oracle/hyperion_planning | < 11.2.8.0 | 11.2.8.0 |
| oracle/hyperion_profitability_and_cost_management | < 11.2.8.0 | 11.2.8.0 |
| oracle/hyperion_tax_provision | < 11.2.8.0 | 11.2.8.0 |
| oracle/identity_management_suite | all versions | — |
| oracle/identity_management_suite | all versions | — |
| oracle/identity_manager_connector | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/insurance_data_gateway | all versions | — |
| oracle/insurance_insbridge_rating_and_underwriting | ≥ 5.4, ≤ 5.6.0.0 | — |
| oracle/insurance_insbridge_rating_and_underwriting | all versions | — |
| oracle/insurance_insbridge_rating_and_underwriting | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/management_cloud_engine | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.29 | — |
| oracle/payment_interface | all versions | — |
| oracle/payment_interface | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/primavera_gateway | ≥ 17.12.0, ≤ 17.12.11 | — |
| oracle/primavera_gateway | ≥ 18.8.0, ≤ 18.8.13 | — |
| oracle/primavera_gateway | ≥ 19.12.0, ≤ 19.12.12 | — |
| oracle/primavera_gateway | ≥ 20.12.0, ≤ 20.12.7 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 19.12.0.0, ≤ 19.12.18.0 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 20.12.0.0, ≤ 20.12.12.0 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_back_office | all versions | — |
| oracle/retail_central_office | all versions | — |
| oracle/retail_customer_insights | all versions | — |
| oracle/retail_customer_insights | all versions | — |
| oracle/retail_data_extractor_for_merchandising | all versions | — |
| oracle/retail_data_extractor_for_merchandising | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_financial_integration | ≥ 16.0.1, ≤ 16.0.3 | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_integration_bus | ≥ 16.0.1, ≤ 16.0.3 | — |
| oracle/retail_integration_bus | ≥ 19.0.0, ≤ 19.0.1.0 | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_management_system | all versions | — |
| oracle/retail_point-of-service | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_service_backbone | ≥ 16.0.1, ≤ 16.0.3 | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/siebel_ui_framework | ≤ 21.12 | — |
| oracle/sql_developer | < 21.4.2 | 21.4.2 |
| oracle/taleo_platform | < 22.1 | 22.1 |
| oracle/utilities_framework | ≥ 4.3.0.1.0, ≤ 4.3.0.6.0 | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_sites | all versions | — |
| oracle/webcenter_sites | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |