CVE-2021-45105 @ Maven-org.apache.logging.log4j:log4j-core-2.3

[margaritalm]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2021-45105
Checkmarx Project: margaritalm/BookStore_Small_CLI_small
Repository URL: https://github.com/margaritalm/BookStore_Small_CLI_small
Branch: master
Scan ID: 79dde67e-447e-480d-9f9e-f0bfb2e3e6f8

---

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3- for users requiring Java 7 and 2.3.1 for users requiring Java 6) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.

Only the log4j-core package is directly affected by this vulnerability.

---

Additional Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.3.2