Vulnerability · Published Dec 28, 2021 · Assigned by apache
CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Medium 6.6
In plain English
A medium-severity improper input validation in Apache Log4j2 from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 97.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | apache-log4j2 | 2.17.1-1 | DEBIAN-CVE-2021-44832 |
| Debian:13 | apache-log4j2 | 2.17.1-1 | DEBIAN-CVE-2021-44832 |
| Debian:14 | apache-log4j2 | 2.17.1-1 | DEBIAN-CVE-2021-44832 |
| Maven | org.apache.logging.log4j:log4j-core | 2.3.2 | GHSA-8489-44mv-ggj8 |
| Maven | org.apache.logging.log4j:log4j-core | 2.17.1 | GHSA-8489-44mv-ggj8 |
| Maven | org.apache.logging.log4j:log4j-core | 2.12.4 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 2.0.14 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.9.2 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.10.9 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.11.13 | GHSA-8489-44mv-ggj8 |
| Ubuntu:25.10 | apache-log4j2 | no fix listed | UBUNTU-CVE-2021-44832 |
| Ubuntu:26.10 | apache-log4j2 | no fix listed | UBUNTU-CVE-2021-44832 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Log4j2 | log4j-core – before 2.17.1 |
Weakness: CWE-20, CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory, x_refsource_CISCO
- https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143 x_refsource_MISC
- https://issues.apache.org/jira/browse/LOG4J2-3293 x_refsource_MISC
- [oss-security] 20211228 CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20211229 [SECURITY] [DLA 2870-1] apache-log4j2 security update mailing-list, x_refsource_MLIST
- https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf x_refsource_CONFIRM
- FEDORA-2021-c6f471ce0f vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-1bd9151bab vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220104-0001/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC