AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0WGTR72

Okta On-Prem MFA Agent

Okta

CVE-2021-45046 · Published Jan 26, 2022

Critical9.0
No fix yet
Okta advisory

Apache Log4j2 2.15.0, as used in Okta On-Prem MFA Agent 1.4.6 (formerly Okta RSA SecurID Agent), contained an incomplete fix for CVE-2021-44228, which could allow attackers under certain conditions to craft malicious input data, resulting in a denial of service (DOS) attack. The new version includes Log4j 2.16.0 which fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 16Severity: Unrated to Critical
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
NVD
Also known as
CVE-2021-44228

More Okta advisories

All Okta
Low 3.9Sep 1, 2022Okta Active Directory AgentCVE-2022-1697no fix yetHigh 8.8Mar 21, 2022Okta Advanced Server Access ClientCVE-2022-1030no fix yetHigh 8.8Feb 17, 2022Okta Advanced Server Access ClientCVE-2022-24295no fix yetMedium 5.9Jan 26, 2022Okta RADIUS Server AgentCVE-2021-45105no fix yetCritical 9.0Jan 26, 2022Okta RADIUS Server AgentCVE-2021-45046no fix yetCritical 10.0Jan 26, 2022Okta On-Prem MFA AgentCVE-2021-44228no fix yet