Apache Log4j CVE-2021-45046 (incomplete Log4Shell fix, Thread Context Lookup RCE, CISA KEV) and Log4j 1.x end of life: which Log4j 2 versions are fixed and is Log4j 1 safe?

What it is: CVE-2021-45046, disclosed in December 2021 shortly after Log4Shell (CVE-2021-44228), showed that the Log4j 2.15.0 fix was incomplete in certain non-default configurations. When a non-default Pattern Layout uses a Thread Context Lookup (for example a ${ctx:...} pattern), an attacker who controls Thread Context Map data can cause an information leak and, in some environments, remote code execution (local code execution in all environments, per Apache). It is in the CISA KEV catalog (added 2023-05-01), and Log4j-related compromises of unpatched applications are still seen. Am I affected: - Only the log4j-core JAR matters; applications using only log4j-api are not affected. - Apache's security page lists affected log4j-core ranges [2.0-beta9, 2.3.1), [2.4, 2.12.3) and [2.13.0, 2.16.0); fixed in 2.3.1 (Java 6), 2.12.3 (Java 7) and 2.16.0 (Java 8 and later). - Log4j 1.x reached end of life in 2015. Apache does not review or fix vulnerabilities reported after August 2015. Log4j 1 has no lookups, so the Log4Shell-style risk is lower, but it is vulnerable to CVE-2021-4104 when JMSAppender is configured, and it will never receive further fixes. - Find copies with your build tool's dependency tree (mvn dependency:tree, gradle dependencies), SBOM scanners, and by searching for log4j-core-*.jar including shaded/fat JARs and vendor products. Fix: 1. Upgrade log4j-core to the current Log4j 2 release for your Java version. At minimum use 2.16.0 on Java 8+, 2.12.3 on Java 7 or 2.3.1 on Java 6, but note that later Log4j 2 releases fixed more issues, and Apache's security page lists many newer advisories, so go to the latest supported release. 2. For Log4j 1.x: remove it or migrate. The Log4j 1 to 2 bridge (log4j-1.2-api) is deprecated, so follow Apache's migration guide, and until then confirm no JMSAppender is configured. 3. For third-party products bundling Log4j, apply the vendor's update; do not rely on editing JARs by hand. 4. If an app was exposed on an affected version, review logs for lookup-style strings in logged input, unexpected outbound connections from the app host, and new processes or files; rebuild affected hosts from clean images and rotate secrets the app could read (environment variables, config files, cloud credentials). Verify: dependency scans and a search of deployed artifacts show no log4j-core below the fixed version and no log4j 1.x on the classpath. Sources: https://logging.apache.org/log4j/2.x/security.html https://nvd.nist.gov/vuln/detail/CVE-2021-45046 https://www.cisa.gov/known-exploited-vulnerabilities-catalog