Second Log4j Flaw CVE-2021-45046 Emerges After Initial Patch Fails
A newly discovered Log4j vulnerability, CVE-2021-45046, reveals that the previous 2.15.0 patch remains incomplete and allows denial-of-service attacks. Experts recommend immediate upgrading or manually removing the JNDI Lookup class to mitigate the risk.
A second major Log4j vulnerability, known as CVE-2021-45046, emerges just one day after the initial Log4Shell disclosure, proving that the first fix is incomplete. This new flaw rates a 3.7 out of 10 on the CVSS scale and impacts Log4j versions from 2.0-beta9 through 2.15.0. Unlike the previous remote code execution issue, this specific vulnerability enables attackers to trigger a denial-of-service (DOS) attack by crafting malicious input data that exploits a JNDI Lookup pattern.
The Apache maintainers release version 2.15.0 to address the original CVE-2021-44228 threat, but this update fails to fully secure non-default configurations. Standard mitigations, such as setting the system property log4j2.noFormatMsgLookup, do not stop this secondary attack vector. Because Log4j is a widely used logging utility, this ongoing issue continues to put a massive range of software and enterprise services at risk across the tech industry.
Security experts strongly advise users to upgrade to the newest available version of Log4j as soon as possible. For systems like Opendistro's Elasticsearch or OpenSearch where immediate upgrading is not feasible, administrators must manually locate the vulnerable log4j jar file, extract and delete the JndiLookup class from the archive, and restart the service. This manual removal effectively eliminates the classpath vulnerability and prevents the DOS attack from succeeding.