Medium severity · published Dec 28, 2021
CVE-2021-44832
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses…
6.6
CVSS
97.9%
EPSS
No
On KEV
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
2.0.1 before 2.3.2; 2.4 before 2.12.4; 2.13.0 before 2.17.1; 2.0; 2.0; 2.0; +3 more · source: NVD
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
CL
Cloudcenter · Cisco
4.10.0.16 · source: NVD
CB
Communications Brm - Elastic Charging Engine · Oracle
before 12.0.0.4.6; 12.0.0.5.0 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
8.0.0.0 through 8.5.1.0; 8.3.0.0 through 8.5.1.0 · source: NVD
CI
Communications Interactive Session Recorder · Oracle
6.3; 6.4; 6.3; 6.4 · source: NVD
CO
Communications Offline Mediation Controller · Oracle
before 12.0.0.4.4; 12.0.0.5.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
FE
Fedora · Fedoraproject
34; 35 · source: NVD
FP
Flexcube Private Banking · Oracle
12.1.0 · source: NVD
HS
Health Sciences Data Management Workbench · Oracle
2.5.2.1; 3.0.0.0; 3.1.0.3 · source: NVD
PA
Policy Automation · Oracle
12.2.0 through 12.2.24 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44832
Mailing List
http://www.openwall.com/lists/oss-security/2021/12/28/1
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf
Issue Tracking
https://issues.apache.org/jira/browse/LOG4J2-3293
Mailing List
https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
Mailing List
https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…