{"id":"CVE-2021-44228","aliases":["CLSA-2026-1790619390","CLSA-2026-1790671828","CLSA-2026-1793725664","CLSA-2026-1793879798","CLSA-2026-1793880396","CLSA-2026-1793880908","DEBIAN-CVE-2021-44228","DLA-2842-1","DSA-5020-1","EUVD-2021-34768","GHSA-jfh8-c2jp-5v3q","MGASA-2021-0556","OESA-2021-1462","OESA-2021-1474","OESA-2022-1943","RHSA-2025:1746","RHSA-2025:1747","SUSE-SU-2021:4096-1","SUSE-SU-2021:4097-1","UBUNTU-CVE-2021-44228","USN-5192-1","USN-5192-2","USN-5197-1","openSUSE-SU-2021:1577-1","openSUSE-SU-2021:1586-1","openSUSE-SU-2021:1601-1","openSUSE-SU-2021:1613-1","openSUSE-SU-2021:3999-1","openSUSE-SU-2021:4094-1","openSUSE-SU-2021:4107-1","openSUSE-SU-2021:4109-1","openSUSE-SU-2024:11666-1","openSUSE-SU-2024:11683-1"],"status":"published","title":"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.99999,"percentile":1,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-400","CWE-502","CWE-917"],"published":"2021-12-10T00:00:00Z","modified":"2026-11-06T13:15:06Z","kev":{"date_added":"2021-12-10","due_date":"2021-12-24","required_action":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-12-10"},{"source":"kev","since":"2021-12-10"}],"exploits":[{"source":"pocgithub","id":"Glease/Healer","title":"Glease/Healer","date":"2021-12-09","url":"https://github.com/Glease/Healer"},{"source":"metasploit","id":"exploit/multi/http/log4shell_header_injection","title":"Log4Shell HTTP Header Injection","type":"exploit","platform":"Java,Unix,Windows","date":"2021-12-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/log4shell_header_injection"},{"source":"metasploit","id":"exploit/multi/http/ubiquiti_unifi_log4shell","title":"UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)","type":"exploit","platform":"Unix,Windows","date":"2021-12-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/ubiquiti_unifi_log4shell"},{"source":"metasploit","id":"exploit/multi/http/vmware_vcenter_log4shell","title":"VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)","type":"exploit","platform":"Unix,Windows","date":"2021-12-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/vmware_vcenter_log4shell"},{"source":"pocgithub","id":"tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce","title":"tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce","date":"2021-12-09","url":"https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce"},{"source":"pocgithub","id":"1in9e/Apache-Log4j2-RCE","title":"1in9e/Apache-Log4j2-RCE","date":"2021-12-10","url":"https://github.com/1in9e/Apache-Log4j2-RCE"},{"source":"pocgithub","id":"Adikso/minecraft-log4j-honeypot","title":"Adikso/minecraft-log4j-honeypot","date":"2021-12-10","url":"https://github.com/Adikso/minecraft-log4j-honeypot"},{"source":"pocgithub","id":"Azeemering/CVE-2021-44228-DFIR-Notes","title":"Azeemering/CVE-2021-44228-DFIR-Notes","date":"2021-12-10","url":"https://github.com/Azeemering/CVE-2021-44228-DFIR-Notes"},{"source":"pocgithub","id":"CreeperHost/Log4jPatcher","title":"CreeperHost/Log4jPatcher","date":"2021-12-10","url":"https://github.com/CreeperHost/Log4jPatcher"},{"source":"pocgithub","id":"DragonSurvivalEU/RCE","title":"DragonSurvivalEU/RCE","date":"2021-12-10","url":"https://github.com/DragonSurvivalEU/RCE"},{"source":"pocgithub","id":"HyCraftHD/Log4J-RCE-Proof-Of-Concept","title":"HyCraftHD/Log4J-RCE-Proof-Of-Concept","date":"2021-12-10","url":"https://github.com/HyCraftHD/Log4J-RCE-Proof-Of-Concept"},{"source":"pocgithub","id":"Kadantte/CVE-2021-44228-poc","title":"Kadantte/CVE-2021-44228-poc","date":"2021-12-10","url":"https://github.com/Kadantte/CVE-2021-44228-poc"},{"source":"pocgithub","id":"KosmX/CVE-2021-44228-example","title":"KosmX/CVE-2021-44228-example","date":"2021-12-10","url":"https://github.com/KosmX/CVE-2021-44228-example"},{"source":"pocgithub","id":"NorthwaveSecurity/log4jcheck","title":"NorthwaveSecurity/log4jcheck","date":"2021-12-10","url":"https://github.com/NorthwaveSecurity/log4jcheck"},{"source":"pocgithub","id":"OopsieWoopsie/mc-log4j-patcher","title":"OopsieWoopsie/mc-log4j-patcher","date":"2021-12-10","url":"https://github.com/OopsieWoopsie/mc-log4j-patcher"},{"source":"pocgithub","id":"Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","title":"Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","date":"2021-12-10","url":"https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words"},{"source":"pocgithub","id":"TheArqsz/CVE-2021-44228-PoC","title":"TheArqsz/CVE-2021-44228-PoC","date":"2021-12-10","url":"https://github.com/TheArqsz/CVE-2021-44228-PoC"},{"source":"pocgithub","id":"alexandreroman/cve-2021-44228-workaround-buildpack","title":"alexandreroman/cve-2021-44228-workaround-buildpack","date":"2021-12-10","url":"https://github.com/alexandreroman/cve-2021-44228-workaround-buildpack"},{"source":"pocgithub","id":"boundaryx/cloudrasp-log4j2","title":"boundaryx/cloudrasp-log4j2","date":"2021-12-10","url":"https://github.com/boundaryx/cloudrasp-log4j2"},{"source":"pocgithub","id":"christophetd/log4shell-vulnerable-app","title":"christophetd/log4shell-vulnerable-app","date":"2021-12-10","url":"https://github.com/christophetd/log4shell-vulnerable-app"},{"source":"pocgithub","id":"dbgee/CVE-2021-44228","title":"dbgee/CVE-2021-44228","date":"2021-12-10","url":"https://github.com/dbgee/CVE-2021-44228"},{"source":"pocgithub","id":"greymd/CVE-2021-44228","title":"greymd/CVE-2021-44228","date":"2021-12-10","url":"https://github.com/greymd/CVE-2021-44228"},{"source":"pocgithub","id":"izzyacademy/log4shell-mitigation","title":"izzyacademy/log4shell-mitigation","date":"2021-12-10","url":"https://github.com/izzyacademy/log4shell-mitigation"},{"source":"pocgithub","id":"jacobtread/L4J-Vuln-Patch","title":"jacobtread/L4J-Vuln-Patch","date":"2021-12-10","url":"https://github.com/jacobtread/L4J-Vuln-Patch"},{"source":"pocgithub","id":"jas502n/Log4j2-CVE-2021-44228","title":"jas502n/Log4j2-CVE-2021-44228","date":"2021-12-10","url":"https://github.com/jas502n/Log4j2-CVE-2021-44228"},{"source":"pocgithub","id":"kozmer/log4j-shell-poc","title":"kozmer/log4j-shell-poc","date":"2021-12-10","url":"https://github.com/kozmer/log4j-shell-poc"},{"source":"pocgithub","id":"lhotari/pulsar-docker-images-patch-CVE-2021-44228","title":"lhotari/pulsar-docker-images-patch-CVE-2021-44228","date":"2021-12-10","url":"https://github.com/lhotari/pulsar-docker-images-patch-CVE-2021-44228"},{"source":"pocgithub","id":"mubix/CVE-2021-44228-Log4Shell-Hashes","title":"mubix/CVE-2021-44228-Log4Shell-Hashes","date":"2021-12-10","url":"https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes"},{"source":"metasploit","id":"exploit/linux/http/mobileiron_core_log4shell","title":"MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)","type":"exploit","platform":"Unix","date":"2021-12-12","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/mobileiron_core_log4shell"},{"source":"exploitdb","id":"EDB-50590","title":"Apache Log4j2 2.14.1 - Information Disclosure","type":"remote","platform":"java","date":"2021-12-14","url":"https://www.exploit-db.com/exploits/50590"},{"source":"exploitdb","id":"EDB-50592","title":"Apache Log4j 2 - Remote Code Execution (RCE)","type":"remote","platform":"java","date":"2021-12-14","url":"https://www.exploit-db.com/exploits/50592"},{"source":"exploitdb","id":"EDB-51183","title":"AD Manager Plus 7122 - Remote Code Execution (RCE)","type":"remote","platform":"java","date":"2023-04-01","url":"https://www.exploit-db.com/exploits/51183"},{"source":"metasploit","id":"auxiliary/scanner/http/log4shell_scanner","title":"Log4Shell HTTP Scanner","type":"auxiliary","date":"2021-12-09","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/log4shell_scanner"},{"source":"nuclei","id":"CVE-2021-44228","title":"Apache Log4j2 Remote Code Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml"}],"exploits_more":482,"fixes":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.15.0","2.12.2","2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","fixed_in":["1.9.2","1.10.8","1.11.10","2.0.11"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.7-tuxcare.3","2.9.1-tuxcare.3","2.8.2-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache-log4j2","fixed_in":["2.15.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache-log4j2","fixed_in":["2.15.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache-log4j2","fixed_in":["2.15.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"apache-log4j2","fixed_in":["2.7-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"apache-log4j2","fixed_in":["2.15.0-1~deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"apache-log4j2","fixed_in":["2.15.0-1~deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"log4j","fixed_in":["2.13.3-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j","fixed_in":["2.13.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"log4j","fixed_in":["2.13.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"flink","fixed_in":["1.12.7-2.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","fixed_in":["2.4-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","fixed_in":["2.10.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","fixed_in":["2.15.0-0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"log4j","fixed_in":["2.13.0-lp152.3.3.1","2.13.0-lp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"logback","fixed_in":["1.2.8-lp152.2.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"log4j","fixed_in":["2.13.0-4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"logback","fixed_in":["1.2.8-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"log4j","fixed_in":["2.13.2-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.15.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.12.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.guicedee.services:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1.2-jre17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xbib.elasticsearch:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.2.1"},{"last_affected":"6.3.2.1"}]}],"versions":["6.3.2.1"]},{"source":"ghsa","ecosystem":"Maven","package":"uk.co.nichesolutions.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-CUSTOM"},{"last_affected":"2.6.3-CUSTOM"}]}],"versions":["2.6.3-CUSTOM"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta9"},{"fixed":"2.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.11"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.0-tuxcare.2"}]}],"versions":["2.11.0","2.11.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5"},{"fixed":"2.5-tuxcare.2"}]}],"versions":["2.5","2.5-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.2"}]}],"versions":["2.10.0","2.10.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.2"}]}],"versions":["2.10.0","2.10.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7-tuxcare.3"}]}],"versions":["2.7","2.7-tuxcare.1","2.7-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.3"}]}],"versions":["2.9.1","2.9.1-tuxcare.1","2.9.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.2"},{"fixed":"2.8.2-tuxcare.3"}]}],"versions":["2.8.2","2.8.2-tuxcare.1","2.8.2-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-2+deb9u1"}]}],"versions":["2.7-2"]},{"source":"osv","ecosystem":"Debian:10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1~deb10u1"}]}],"versions":["2.11.1-2","2.11.2-1","2.13.3-1"]},{"source":"osv","ecosystem":"Debian:11","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1~deb11u1"}]}],"versions":["2.13.3-1","2.15.0-1~deb10u1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.15.0"}]}],"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta9"},{"fixed":"2.3.1"}]}],"versions":["2.0","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.2","2.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.12.2"}]}],"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Maven","package":"com.guicedee.services:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1.2-jre17"}]}],"versions":["1.0.10.0","1.0.10.0-jre13","1.0.10.0-jre14","1.0.10.1","1.0.10.1-jre14","1.0.10.3","1.0.10.3-jre14","1.0.10.4","1.0.10.4-jre12","1.0.10.4-jre13","1.0.10.4-jre14","1.0.11.0-jre14","1.0.11.2-jre14","1.0.11.5","1.0.11.5-jre12","1.0.11.5-jre14","1.0.11.6-jre14","1.0.11.7","1.0.11.7-jre12","1.0.11.7-jre14","1.0.12.0","1.0.12.0-jre12","1.0.12.0-jre13","1.0.12.0-jre14","1.0.12.0-jre8","1.0.12.1","1.0.12.1-jre12","1.0.12.1-jre14","1.0.12.2","1.0.12.2-jre12","1.0.12.2-jre14","1.0.12.3","1.0.12.3-jre12","1.0.12.3-jre13","1.0.12.3-jre14","1.0.12.4","1.0.12.4-jre12","1.0.12.4-jre13","1.0.12.4-jre14","1.0.12.4-jre8","1.0.12.5","1.0.12.5-jre14","1.0.13.0","1.0.13.0-jre12","1.0.13.0-jre13","1.0.13.0-jre14","1.0.13.0-jre8","1.0.13.1","1.0.13.1-jre13","1.0.13.1-jre14","1.0.13.1-jre8","1.0.13.2","1.0.13.2-jre12","1.0.13.2-jre13","1.0.13.2-jre14","1.0.13.2-jre8","1.0.13.3","1.0.13.3-jre14","1.0.13.4","1.0.13.4-jre12","1.0.13.4-jre13","1.0.13.4-jre14","1.0.13.5","1.0.13.5-jre12","1.0.13.5-jre14","1.0.13.5-jre8","1.0.14.0-RC1-jre14","1.0.14.0-RC1-jre8","1.0.14.1","1.0.14.1-jre12","1.0.14.1-jre13","1.0.14.1-jre14","1.0.14.1-jre8","1.0.14.3-jre8","1.0.14.4-jre14","1.0.14.4-jre8","1.0.15.1","1.0.15.1-jre12","1.0.15.1-jre13","1.0.15.1-jre14","1.0.15.1-jre8","1.0.15.2","1.0.15.2-jre12","1.0.15.2-jre14","1.0.15.2-jre8","1.0.15.3-jre14","1.0.15.3-jre8","1.0.15.4","1.0.15.4-jre14","1.0.15.4-jre8","1.0.15.5","1.0.15.5-jre14","1.0.15.5-jre8","1.0.16.0","1.0.16.0-jre14","1.0.16.0-jre8","1.0.17.0","1.0.17.0-jre14","1.0.17.1","1.0.17.1-jre14","1.0.17.1-jre8","1.0.18.0","1.0.18.0-jre14","1.0.18.0-jre15","1.0.18.0-jre8","1.0.18.1","1.0.18.1-jre14","1.0.18.1-jre15","1.0.18.1-jre8","1.0.19.0","1.0.19.0-jre14","1.0.19.0-jre15","1.0.19.1","1.0.19.1-jre12","1.0.19.1-jre13","1.0.19.1-jre14","1.0.19.1-jre15","1.0.19.1-jre8","1.0.19.10","1.0.19.10-jre12","1.0.19.10-jre14","1.0.19.10-jre15","1.0.19.10-jre8","1.0.19.11","1.0.19.11-jre14","1.0.19.11-jre8","1.0.19.12-jre14","1.0.19.12-jre8","1.0.19.13","1.0.19.13-jre14","1.0.19.13-jre15","1.0.19.13-jre8","1.0.19.2","1.0.19.2-jre13","1.0.19.2-jre14","1.0.19.2-jre15","1.0.19.2-jre8","1.0.19.3","1.0.19.3-jre13","1.0.19.3-jre14","1.0.19.3-jre15","1.0.19.3-jre8","1.0.19.4","1.0.19.4-jre14","1.0.19.4-jre15","1.0.19.4-jre8","1.0.19.5","1.0.19.5-jre14","1.0.19.5-jre15","1.0.19.5-jre8","1.0.19.6","1.0.19.6-jre14","1.0.19.6-jre8","1.0.19.7-jre14","1.0.19.7-jre8","1.0.19.8-jre8","1.0.19.9","1.0.19.9-jre13","1.0.19.9-jre14","1.0.19.9-jre15","1.0.19.9-jre8","1.0.2.15","1.0.2.15-jre13","1.0.2.16-jre13","1.0.2.17-jre13","1.0.2.18","1.0.2.18-jre12","1.0.2.18-jre13","1.0.20.0","1.0.20.0-jre14","1.0.20.0-jre15","1.0.20.0-jre8","1.0.20.1","1.0.20.1-jre14","1.0.20.1-jre15","1.0.20.1-jre8","1.0.20.2","1.0.20.2-jre14","1.0.20.2-jre15","1.0.20.2-jre8","1.0.3.1-jre13","1.0.3.2","1.0.3.2-jre13","1.0.3.3","1.0.3.3-jre12","1.0.3.3-jre13","1.0.4.1-jre13","1.0.4.2","1.0.4.2-jre13","1.0.4.3-jre13","1.0.4.4","1.0.4.4-jre13","1.0.5.0","1.0.5.0-jre13","1.0.5.1","1.0.5.1-jre12","1.0.5.1-jre13","1.0.5.2","1.0.5.2-jre12","1.0.5.2-jre13","1.0.5.3","1.0.5.3-jre12","1.0.5.3-jre13","1.0.5.4-jre13","1.0.5.4-jre14","1.0.5.5","1.0.5.5-jre12","1.0.5.5-jre13","1.0.5.5-jre14","1.0.6.1","1.0.6.1-jre12","1.0.6.1-jre13","1.0.6.1-jre14","1.0.6.2","1.0.6.2-jre12","1.0.6.2-jre13","1.0.6.2-jre14","1.0.6.3","1.0.6.3-jre12","1.0.6.3-jre13","1.0.6.3-jre14","1.0.6.4-jre14","1.0.6.5","1.0.6.5-jre12","1.0.6.5-jre13","1.0.6.5-jre14","1.0.6.7","1.0.6.7-jre14","1.0.7.0","1.0.7.0-jre12","1.0.7.0-jre13","1.0.7.0-jre14","1.0.7.1","1.0.7.1-jre13","1.0.7.1-jre14","1.0.7.10","1.0.7.10-jre13","1.0.7.10-jre14","1.0.7.11","1.0.7.11-jre14","1.0.7.12","1.0.7.12-jre12","1.0.7.12-jre13","1.0.7.12-jre14","1.0.7.2-jre14","1.0.7.3","1.0.7.3-jre13","1.0.7.3-jre14","1.0.7.4","1.0.7.4-jre14","1.0.7.5","1.0.7.5-jre14","1.0.7.6","1.0.7.6-jre14","1.0.7.9","1.0.7.9-jre14","1.0.8.1","1.0.8.1-jre14","1.0.8.12","1.0.8.12-jre12","1.0.8.12-jre14","1.0.8.16","1.0.8.16-jre14","1.0.8.18","1.0.8.18-jre14","1.0.8.2","1.0.8.2-jre13","1.0.8.2-jre14","1.0.8.3","1.0.8.3-jre13","1.0.8.3-jre14","1.0.8.4","1.0.8.4-jre12","1.0.8.4-jre13","1.0.8.4-jre14","1.0.8.5","1.0.8.5-jre12","1.0.8.5-jre13","1.0.8.5-jre14","1.0.8.6-jre14","1.0.9.0","1.0.9.0-jre14","1.0.9.1","1.0.9.1-jre14","1.0.9.10","1.0.9.10-jre14","1.0.9.11","1.0.9.11-jre14","1.0.9.13","1.0.9.13-jre14","1.0.9.14","1.0.9.14-jre14","1.0.9.2","1.0.9.2-jre14","1.0.9.3-jre14","1.0.9.4-jre14","1.0.9.5-jre14","1.0.9.7-jre14","1.1.0.0-jre15","1.1.0.1","1.1.0.1-jre14","1.1.0.1-jre15","1.1.0.2","1.1.0.2-jre14","1.1.0.2-jre15","1.1.0.3","1.1.0.3-jre14","1.1.0.3-jre15","1.1.0.3-jre8","1.1.0.4-jre14","1.1.0.4-jre15","1.1.0.4-jre8","1.1.0.5-jre14","1.1.0.5-jre15","1.1.0.6","1.1.0.6-jre14","1.1.0.6-jre15","1.1.0.7","1.1.0.7-jre14","1.1.0.7-jre15","1.1.0.7-jre8","1.1.0.8-SNAPSHOT-jre14","1.1.1.0","1.1.1.0-SNAPSHOT-jre14","1.1.1.0-SNAPSHOT-jre15","1.1.1.0-SNAPSHOT-jre8","1.1.1.0-jre14","1.1.1.0-jre15","1.1.1.0-jre8","1.1.1.1-SP1","1.1.1.1-jre14-SP1","1.1.1.1-jre15-SP1","1.1.1.2","1.1.1.2-jre14","1.1.1.2-jre15","1.1.1.3","1.1.1.3-jre14","1.1.1.3-jre15","1.1.1.3-jre16","1.1.1.3-jre8","1.1.1.4","1.1.1.4-jre14","1.1.1.4-jre15","1.1.1.4-jre16","1.1.1.4-jre8","1.1.1.5-jre15","1.1.1.7","1.1.1.7-jre15","1.1.1.7-jre16","1.1.1.7-jre8","1.1.1.8-jre15","1.1.1.8-jre16","1.1.1.9-jre15","1.1.1.9-jre16","1.2.0.0-jre16","1.2.0.1-jre11","1.2.0.1-jre15","1.2.0.1-jre16","1.2.0.2-jre16","1.2.0.3-jre17-rc1","1.2.1.1-jre17","1.2.1.2-jre17"]},{"source":"osv","ecosystem":"Maven","package":"org.xbib.elasticsearch:log4j","versions":["6.3.2.1"]},{"source":"osv","ecosystem":"Maven","package":"uk.co.nichesolutions.logging.log4j:log4j-core","versions":["2.6.3-CUSTOM"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}],"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.8"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.10"}]}],"versions":["1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.11"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Mageia:8","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.3-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"metrics-3.1.2-3.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"metrics-3.1.2-3.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"flink","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jsapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-json-p-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-multipart-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-validator-provider-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-yaml-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-3.redhat_00006.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.9-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.9-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jettison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-1.Final_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-1.Final_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.SP1_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.17-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jsr310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jettison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-client-microprofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jsapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-json-binding-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-json-p-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-multipart-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-validator-provider-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-yaml-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2ubuntu0.1~esm1"}]}],"versions":["2.2-1","2.4-1","2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-2ubuntu0.1"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-0.20.04.1"}]}],"versions":["2.11.1-2","2.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-2ubuntu0.1"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-0.20.04.1"}]}],"versions":["2.11.1-2","2.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2ubuntu0.1~esm1"}]}],"versions":["2.2-1","2.4-1","2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-0.20.04.1"}]}],"versions":["2.11.1-2","2.11.2-1","2.15.0-0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-lp152.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"disruptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-lp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"jakarta-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-lp152.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-lp152.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"logback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8-lp152.2.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"disruptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"jakarta-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"logback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-2.1"}]}]}],"products":[{"vendor":"apache","product":"log4j"},{"vendor":"apache","product":"log4j2"},{"vendor":"apache software foundation","product":"apache log4j2"},{"vendor":"apple","product":"xcode"},{"vendor":"bentley","product":"synchro"},{"vendor":"bentley","product":"synchro_4d"},{"vendor":"cisco","product":"advanced_malware_protection_virtual_private_cloud_appliance"},{"vendor":"cisco","product":"automated_subsea_tuning"},{"vendor":"cisco","product":"broadworks"},{"vendor":"cisco","product":"business_process_automation"},{"vendor":"cisco","product":"cloud_connect"},{"vendor":"cisco","product":"cloudcenter"},{"vendor":"cisco","product":"cloudcenter_cost_optimizer"},{"vendor":"cisco","product":"cloudcenter_suite"},{"vendor":"cisco","product":"cloudcenter_suite_admin"},{"vendor":"cisco","product":"cloudcenter_workload_manager"},{"vendor":"cisco","product":"common_services_platform_collector"},{"vendor":"cisco","product":"connected_mobile_experiences"},{"vendor":"cisco","product":"contact_center_domain_manager"},{"vendor":"cisco","product":"contact_center_management_portal"},{"vendor":"cisco","product":"crosswork_data_gateway"},{"vendor":"cisco","product":"crosswork_network_automation"},{"vendor":"cisco","product":"crosswork_network_controller"},{"vendor":"cisco","product":"crosswork_optimization_engine"},{"vendor":"cisco","product":"crosswork_platform_infrastructure"},{"vendor":"cisco","product":"crosswork_zero_touch_provisioning"},{"vendor":"cisco","product":"customer_experience_cloud_agent"},{"vendor":"cisco","product":"cx_cloud_agent"},{"vendor":"cisco","product":"cyber_vision"},{"vendor":"cisco","product":"cyber_vision_sensor_management_extension"},{"vendor":"cisco","product":"data_center_network_manager"},{"vendor":"cisco","product":"dna_center"},{"vendor":"cisco","product":"dna_spaces"},{"vendor":"cisco","product":"dna_spaces\\"},{"vendor":"cisco","product":"dna_spaces_connector"},{"vendor":"cisco","product":"emergency_responder"},{"vendor":"cisco","product":"enterprise_chat_and_email"},{"vendor":"cisco","product":"evolved_programmable_network_manager"},{"vendor":"cisco","product":"finesse"},{"vendor":"cisco","product":"fog_director"},{"vendor":"cisco","product":"fxos"},{"vendor":"cisco","product":"identity_services_engine"},{"vendor":"cisco","product":"integrated_management_controller_supervisor"},{"vendor":"cisco","product":"intersight_virtual_appliance"},{"vendor":"cisco","product":"iot_operations_dashboard"},{"vendor":"cisco","product":"mobility_services_engine"},{"vendor":"cisco","product":"network_assurance_engine"},{"vendor":"cisco","product":"network_dashboard_fabric_controller"},{"vendor":"cisco","product":"network_insights_for_data_center"},{"vendor":"cisco","product":"network_services_orchestrator"},{"vendor":"cisco","product":"nexus_dashboard"},{"vendor":"cisco","product":"nexus_insights"},{"vendor":"cisco","product":"optical_network_controller"},{"vendor":"cisco","product":"packaged_contact_center_enterprise"},{"vendor":"cisco","product":"paging_server"},{"vendor":"cisco","product":"prime_service_catalog"},{"vendor":"cisco","product":"sd-wan_vmanage"},{"vendor":"cisco","product":"secure_firewall_threat_defense"},{"vendor":"cisco","product":"smart_phy"},{"vendor":"cisco","product":"ucs_central"},{"vendor":"cisco","product":"ucs_central_software"},{"vendor":"cisco","product":"ucs_director"},{"vendor":"cisco","product":"unified_communications_manager"},{"vendor":"cisco","product":"unified_communications_manager_im_\\\u0026_presence_service"},{"vendor":"cisco","product":"unified_communications_manager_im_and_presence_service"},{"vendor":"cisco","product":"unified_computing_system"},{"vendor":"cisco","product":"unified_contact_center_enterprise"},{"vendor":"cisco","product":"unified_contact_center_express"},{"vendor":"cisco","product":"unified_contact_center_management_portal"},{"vendor":"cisco","product":"unified_customer_voice_portal"},{"vendor":"cisco","product":"unified_intelligence_center"},{"vendor":"cisco","product":"unified_sip_proxy"},{"vendor":"cisco","product":"unified_workforce_optimization"},{"vendor":"cisco","product":"unity_connection"},{"vendor":"cisco","product":"video_surveillance_manager"},{"vendor":"cisco","product":"video_surveillance_operations_manager"},{"vendor":"cisco","product":"virtual_topology_system"},{"vendor":"cisco","product":"virtualized_infrastructure_manager"},{"vendor":"cisco","product":"virtualized_voice_browser"},{"vendor":"cisco","product":"wan_automation_engine"},{"vendor":"cisco","product":"webex_meetings_server"},{"vendor":"cisco","product":"workload_optimization_manager"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"intel","product":"computer_vision_annotation_tool"},{"vendor":"intel","product":"datacenter_manager"},{"vendor":"intel","product":"genomics_kernel_library"},{"vendor":"intel","product":"oneapi_sample_browser"},{"vendor":"intel","product":"secure_device_onboard"},{"vendor":"intel","product":"system_studio"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"brocade_san_navigator"},{"vendor":"netapp","product":"cloud_insights"},{"vendor":"netapp","product":"cloud_manager"},{"vendor":"netapp","product":"cloud_secure_agent"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"ontap_tools"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"solidfire_enterprise_sds"},{"vendor":"percussion","product":"rhythmyx"},{"vendor":"siemens","product":"6bk1602-0aa12-0tp0_firmware"},{"vendor":"siemens","product":"6bk1602-0aa22-0tp0_firmware"},{"vendor":"siemens","product":"6bk1602-0aa32-0tp0_firmware"},{"vendor":"siemens","product":"6bk1602-0aa42-0tp0_firmware"},{"vendor":"siemens","product":"6bk1602-0aa52-0tp0_firmware"},{"vendor":"siemens","product":"capital"},{"vendor":"siemens","product":"comos"},{"vendor":"siemens","product":"desigo_cc_advanced_reports"},{"vendor":"siemens","product":"desigo_cc_info_center"},{"vendor":"siemens","product":"e-car_operation_center"},{"vendor":"siemens","product":"energy_engage"},{"vendor":"siemens","product":"energyip"},{"vendor":"siemens","product":"energyip_prepay"},{"vendor":"siemens","product":"gma-manager"},{"vendor":"siemens","product":"head-end_system_universal_device_integration_system"},{"vendor":"siemens","product":"industrial_edge_management"},{"vendor":"siemens","product":"industrial_edge_management_hub"},{"vendor":"siemens","product":"logo\\!_soft_comfort"},{"vendor":"siemens","product":"mendix"},{"vendor":"siemens","product":"mindsphere"},{"vendor":"siemens","product":"navigator"},{"vendor":"siemens","product":"nx"},{"vendor":"siemens","product":"opcenter_intelligence"},{"vendor":"siemens","product":"operation_scheduler"},{"vendor":"siemens","product":"sentron_powermanager"},{"vendor":"siemens","product":"siguard_dsa"},{"vendor":"siemens","product":"sipass_integrated"},{"vendor":"siemens","product":"siveillance_command"},{"vendor":"siemens","product":"siveillance_control_pro"},{"vendor":"siemens","product":"siveillance_identity"},{"vendor":"siemens","product":"siveillance_vantage"},{"vendor":"siemens","product":"siveillance_viewpoint"},{"vendor":"siemens","product":"solid_edge_cam_pro"},{"vendor":"siemens","product":"solid_edge_harness_design"},{"vendor":"siemens","product":"spectrum_power_4"},{"vendor":"siemens","product":"spectrum_power_7"},{"vendor":"siemens","product":"sppa-t3000_ses3000_firmware"},{"vendor":"siemens","product":"teamcenter"},{"vendor":"siemens","product":"vesys"},{"vendor":"siemens","product":"xpedition_enterprise"},{"vendor":"siemens","product":"xpedition_package_integrator"},{"vendor":"snowsoftware","product":"snow_commander"},{"vendor":"snowsoftware","product":"vm_access_proxy"},{"vendor":"sonicwall","product":"email_security"}],"references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/1","tags":["mailing-list","x_transferred","Mailing List","Mitigation","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/2","tags":["mailing-list","x_transferred","Mailing List","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-5020","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","tags":["vendor-advisory","x_transferred","Release Notes","advisory"]},{"url":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","tags":["vendor-advisory","x_transferred","Patch","Third Party Advisory","Vendor Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.kb.cert.org/vuls/id/930724","tags":["third-party-advisory","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://twitter.com/kurtseifried/status/1469345530182455296","tags":["x_transferred","Broken Link","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/15/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","tags":["x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","tags":["vendor-advisory","x_transferred","Release Notes","advisory"]},{"url":"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","tags":["x_transferred","Broken Link","Product","US Government Resource","web"]},{"url":"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/23","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/cisagov/log4j-affected-db","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213189","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Jul/11","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/2","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","web"]},{"url":"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/608","tags":["web","report"]},{"url":"https://github.com/tangxiaofeng7/apache-log4j-poc","tags":["web","report"]},{"url":"https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0","tags":["web"]},{"url":"https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3198","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3201","tags":["web"]},{"url":"https://logging.apache.org/log4j/2.x/manual/migration.html","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3214","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3221","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7rjr-3q55-vv33","tags":["advisory"]},{"url":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0007","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/5501","tags":["web"]},{"url":"https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","tags":["web"]},{"url":"https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","tags":["web"]},{"url":"https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","tags":["web"]},{"url":"https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","tags":["web"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["web"]},{"url":"https://seclists.org/fulldisclosure/2022/Dec/2","tags":["web"]},{"url":"https://seclists.org/fulldisclosure/2022/Jul/11","tags":["web"]},{"url":"https://seclists.org/fulldisclosure/2022/Mar/23","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","tags":["advisory","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44228","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0556.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29753","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/10/1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1462","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45046","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1943","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1746","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1815470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1815495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032580","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2145194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155970","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-28583","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1746.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9546","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9547","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9548","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10673","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44228","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2021-009","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44228","tags":["advisory","report"]},{"url":"https://www.lunasec.io/docs/blog/log4j-zero-day/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45046","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471","tags":["advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42003","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45047","tags":["advisory"]},{"url":"https://www.mail-archive.com/dev@mina.apache.org/msg39312.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46363","tags":["advisory"]},{"url":"https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1747","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-28581","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1747.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42392","tags":["advisory"]},{"url":"https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214096-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193611","tags":["report"]},{"url":"https://bugzilla.suse.com/1193641","tags":["report"]},{"url":"https://bugzilla.suse.com/1193662","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44228","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214097-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44228","tags":["report"]},{"url":"https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell","tags":["report"]},{"url":"https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5192-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5197-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5192-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45046","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OHVQSNSG4OZ336XWLNWGUL3TQE2ZZODK/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MM3SIUADOVLPKKTSRFXAGFZXOZH63CFG/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YLSFAYMV5DOWQ3EO5252SX7QTCHNCWGK/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45046","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HKG4SHDRVYYGSRQNKBCCH6YJUQX2D54K/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193795","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5KJHAK7MUO47JBMMPGGMJ3EKQX3P7TAO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RDZ2MV2SSNKVN4EVV5AQ3HGQ2G4U2JHS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PCJYMTCVZUNMRYAU55HAMIA6VB3BO7SY/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GICANZVVUJZMKRG5INZ4A2FGAEWOEJQD/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44228","title":"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T00:00:00Z","modified":"2025-10-21T23:25:23.121Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502","CWE-400","CWE-20"],"updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-34768","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T00:00:00Z","modified":"2025-10-21T23:25:23Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-12-10","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-jfh8-c2jp-5v3q","title":"Remote code injection in Log4j","description":"# Summary\n\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\nAs per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 \u003c=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.\n\nLog4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory.\n\n# Impact\n\nLogging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. \n\n# Affected versions\n\nAny Log4J version prior to v2.15.0 is affected to this specific issue.\n\nThe v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.\n\n## Security releases\nAdditional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3\n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Remediation Advice\n\n## Updated advice for version 2.16.0\n\nThe Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0).\nEven in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33).\n\nUsers who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221).\n\nPlease note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.","status":"published","published":"2021-12-10T00:40:56Z","modified":"2025-10-22T19:13:26Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-20","CWE-400","CWE-502","CWE-917"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2021-44228","title":"Apache Log4j2 Remote Code Execution Vulnerability","description":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","cwes":["CWE-20","CWE-400","CWE-502"],"kev":{"date_added":"2021-12-10","due_date":"2021-12-24","required_action":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T10:15:09.143Z","modified":"2026-08-11T19:33:44.513Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-400","CWE-502","CWE-917"],"updated_at":"2026-11-02T14:07:02.189991Z"}],"osv":[{"id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T10:15:09.143Z","modified":"2026-10-24T10:30:50.770243089Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T10:15:09.143Z","modified":"2026-10-23T18:04:16.867309323Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-jfh8-c2jp-5v3q","title":"Remote code injection in Log4j","description":"# Summary\n\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\nAs per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 \u003c=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.\n\nLog4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory.\n\n# Impact\n\nLogging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. \n\n# Affected versions\n\nAny Log4J version prior to v2.15.0 is affected to this specific issue.\n\nThe v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.\n\n## Security releases\nAdditional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3\n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Remediation Advice\n\n## Updated advice for version 2.16.0\n\nThe Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0).\nEven in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33).\n\nUsers who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221).\n\nPlease note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.","status":"published","published":"2021-12-10T00:40:56Z","modified":"2025-10-22T19:37:02.616807Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-20","CWE-400","CWE-502","CWE-917"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"OESA-2021-1462","title":"log4j security update","description":"Java logging package.\n\nSecurity Fix(es):\n\nThe details of a high-risk vulnerability in Apache Log4j2 have been disclosed. Attackers can use the vulnerability to execute code remotely. Some reports carry suspected POC; Apache Log4j2 is a Java-based logging tool. This tool rewrites the Log4j framework and introduces a large number of rich features. The log framework is widely used in business system development to record log information. In most cases, developers may write error messages caused by user input into the log. The trigger condition of this vulnerability is that as long as the data input by external users will be recorded in the log, it can cause remote code execution.(CVE-2021-44228)","status":"published","published":"2021-12-11T11:04:44Z","modified":"2026-08-18T01:16:15.470369211Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2021-1474","title":"log4j security update","description":"Log4j is a tool to help the programmer output log statements to a variety of output targets.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.(CVE-2021-45105)\nIt was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.(CVE-2021-45046)\nThe details of a high-risk vulnerability in Apache Log4j2 have been disclosed. Attackers can use the vulnerability to execute code remotely. Some reports carry suspected POC, Apache Log4j2 is a Java-based logging tool. This tool rewrites the Log4j framework and introduces a large number of rich features. The log framework is widely used in business system development to record log information. In most cases, developers may write error messages caused by user input into the log. The trigger condition of this vulnerability is that as long as the data input by external users will be recorded in the log, it can cause remote code execution.(CVE-2021-44228)","status":"published","published":"2021-12-25T11:04:45Z","modified":"2026-08-18T01:16:15.832955501Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2022-1943","title":"flink security update","description":"Apache Flink is a framework and distributed processing engine for stateful computations over unbounded and bounded data streams. Flink has been designed to run in all common cluster environments, perform computations at in-memory speed and at any scale.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.(CVE-2021-44228)","status":"published","published":"2022-09-23T11:05:15Z","modified":"2026-08-18T01:17:18.024212402Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2025:1746","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update","status":"published","published":"2025-02-24T10:02:47Z","modified":"2026-10-14T10:08:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:1747","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update","status":"published","published":"2025-02-24T10:02:48Z","modified":"2026-10-14T10:08:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","status":"published","published":"2021-12-10T00:00:00Z","modified":"2026-02-04T04:37:06.681826Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"CLSA-2026-1790619390","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.11.0-tuxcare.2.","status":"published","published":"2026-09-28T18:16:30Z","modified":"2026-11-02T19:46:25.038024016Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1790671828","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.5-tuxcare.2.","status":"published","published":"2026-09-29T08:50:28Z","modified":"2026-11-02T19:46:25.570594732Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1793725664","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.10.0-tuxcare.2.","status":"published","published":"2026-11-03T18:07:45Z","modified":"2026-11-03T19:30:09.64142048Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793879798","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.7-tuxcare.3.","status":"published","published":"2026-11-05T12:56:38Z","modified":"2026-11-06T13:15:05.06854742Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793880396","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.9.1-tuxcare.3.","status":"published","published":"2026-11-05T13:06:37Z","modified":"2026-11-06T13:15:05.862997462Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793880908","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.8.2-tuxcare.3.","status":"published","published":"2026-11-05T13:15:09Z","modified":"2026-11-06T13:15:06.070199535Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"DLA-2842-1","title":"apache-log4j2 - security update","status":"published","published":"2021-12-12T00:00:00Z","modified":"2026-03-09T01:18:09.685508Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5020-1","title":"apache-log4j2 - security update","status":"published","published":"2021-12-11T00:00:00Z","modified":"2026-03-09T02:11:10.887016Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0556","title":"Updated log4j packages fix security vulnerability","description":"Apache Log4j2 \u003c=2.14.1 JNDI features used in configuration, log messages,\nand parameters do not protect against attacker controlled LDAP and other\nJNDI related endpoints. An attacker who can control log messages or log\nmessage parameters can execute arbitrary code loaded from LDAP servers\nwhen message lookup substitution is enabled. From log4j 2.15.0, this\nbehavior has been disabled by default. (CVE-2021-44228)\n","status":"published","published":"2021-12-11T01:02:37Z","modified":"2026-04-16T04:41:34.808360465Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1577-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\n- CVE-2021-44228: Fix a remote code execution vulnerability that existed in the\n  LDAP JNDI parser. [bsc#1193611, CVE-2021-44228]\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-12-13T10:48:55Z","modified":"2026-02-04T03:24:03.449096Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1586-1","title":"Security update for log4j","description":"This update for log4j fixes the following issue:\n\nCVE-2021-44228: The previously published fix by upstream turned out to be\nincomplete. Therefore, upstream has recommended disabling JNDI support in log4j\nby default to be completely sure that this vulnerability cannot be exploited.\nThis update implements that recommendation and disables JNDI support by\ndefault. [bsc#1193611, CVE-2021-44228]\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-12-15T08:27:49Z","modified":"2026-02-04T04:02:36.164919Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1601-1","title":"Security update for log4j","description":"This update for log4j fixes the following issue:\n\n- Previously published fixes for log4jshell turned out to be incomplete.\n  Upstream has followed up on the original patch for CVE-2021-44228 with\n  several additional changes (LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and\n  LOG4J2-3211) that are included in this update. Since the totality of\n  those patches is pretty much equivalent to an update to the latest\n  version of log4j, we did update the package's tarball from version\n  2.13.0 to 2.16.0 instead of trying to apply those patches to the old\n  version. This change brings in a new dependency on 'jakarta-servlet'\n  and a version update of 'disruptor'. [bsc#1193743, CVE-2021-45046]\n\nThis update was imported from SUSE:SLE-15-SP2:Update.\n","status":"published","published":"2021-12-20T09:16:57Z","modified":"2026-02-04T02:19:53.629141Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1613-1","title":"Security update for logback","description":"This update for logback fixes the following issues:\n\nUpgrade to version 1.2.8\n\n+ In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback\n  has been disabled until further notice. This impacts\n  ContextJNDISelector and insertFromJNDI element in\n  configuration files.\n+ Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related\n  code in the project has been removed with no replacement.\n+ Note that the vulnerability mentioned in LOGBACK-1591 requires\n  write access to logback's configuration file as a\n  prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591\n  are of different severity levels. A successful RCE requires\n  all of the following conditions to be met:\n  - write access to logback.xml\n  - use of versions lower then 1.2.8\n  - reloading of poisoned configuration data, which implies\n    application restart or scan='true' set prior to attack\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-12-24T15:51:59Z","modified":"2026-02-04T04:19:30.20739Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3999-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\n- CVE-2021-44228: Fix a remote code execution vulnerability that existed in the\n  LDAP JNDI parser. [bsc#1193611, CVE-2021-44228]\n","status":"published","published":"2021-12-12T09:17:54Z","modified":"2026-02-04T04:04:09.426592Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4094-1","title":"Security update for log4j","description":"This update for log4j fixes the following issue:\n\nCVE-2021-44228: The previously published fix by upstream turned out to be\nincomplete. Therefore, upstream has recommended disabling JNDI support in log4j\nby default to be completely sure that this vulnerability cannot be exploited.\n\nThis update implements that recommendation and disables JNDI support by\ndefault. [bsc#1193611, CVE-2021-44228]\n\nCVE-2021-45046: A Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack \nis also fixed by disabling JNDI support by default (bsc#1193743)\n","status":"published","published":"2021-12-15T10:17:28Z","modified":"2025-05-07T18:13:22.651399Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4107-1","title":"Security update for log4j","description":"This update for log4j fixes the following issue:\n\n- Previously published fixes for log4jshell turned out to be incomplete.\n  Upstream has followed up on the original patch for CVE-2021-44228 with\n  several additional changes (LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and\n  LOG4J2-3211) that are included in this update. Since the totality of\n  those patches is pretty much equivalent to an update to the latest\n  version of log4j, we did update the package's tarball from version\n  2.13.0 to 2.16.0 instead of trying to apply those patches to the old\n  version. This change brings in a new dependency on 'jakarta-servlet'\n  and a version update of 'disruptor'. [bsc#1193743, CVE-2021-45046]\n","status":"published","published":"2021-12-16T18:02:27Z","modified":"2026-02-04T03:40:33.724521Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4109-1","title":"Security update for logback","description":"This update for logback fixes the following issues:\n\nUpgrade to version 1.2.8\n\n+ In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback\n  has been disabled until further notice. This impacts\n  ContextJNDISelector and insertFromJNDI element in\n  configuration files.\n+ Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related\n  code in the project has been removed with no replacement.\n+ Note that the vulnerability mentioned in LOGBACK-1591 requires\n  write access to logback's configuration file as a\n  prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591\n  are of different severity levels. A successful RCE requires\n  all of the following conditions to be met:\n  - write access to logback.xml\n  - use of versions lower then 1.2.8\n  - reloading of poisoned configuration data, which implies\n    application restart or scan='true' set prior to attack\n","status":"published","published":"2021-12-17T08:40:59Z","modified":"2026-02-04T04:36:33.934664Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11666-1","title":"log4j-2.13.2-2.1 on GA media","description":"These are all security issues fixed in the log4j-2.13.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:22.838995Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11683-1","title":"logback-1.2.8-1.1 on GA media","description":"These are all security issues fixed in the logback-1.2.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:22.905988Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:4096-1","title":"Security update for storm","description":"This update for storm fixes the following issues:\n\n- Remove JndiLookup from log4j 2.x jars during build to prevent 'log4shell' code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228)\n- Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104)\n","status":"published","published":"2021-12-15T10:31:48Z","modified":"2026-02-04T03:44:58.517555Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2021:4097-1","title":"Security update for storm-kit","description":"This update for storm-kit fixes the following issues:\n\n- Remove JndiLookup from log4j 2.x jars during build to\n  prevent 'log4shell' code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228)\n- Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104)\n","status":"published","published":"2021-12-15T10:32:17Z","modified":"2026-02-04T03:51:45.369503Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5192-1","title":"apache-log4j2 vulnerability","description":"Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run\nprograms via a special crafted input. An attacker could use this vulnerability\nto cause a denial of service or possibly execute arbitrary code.\nPlease see the following link for more information:\nhttps://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell\n","status":"published","published":"2021-12-14T13:39:20Z","modified":"2026-02-10T04:42:24Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5192-2","title":"apache-log4j2 vulnerability","description":"USN-5192-1 fixed a vulnerability in Apache Log4j 2. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run\n programs via a special crafted input. An attacker could use this vulnerability\n to cause a denial of service or possibly execute arbitrary code.\n","status":"published","published":"2021-12-17T12:46:46Z","modified":"2026-06-25T13:30:53.454517284Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5197-1","title":"apache-log4j2 vulnerability","description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was\nincomplete in certain non-default configurations. An attacker could use this\nvulnerability to cause a denial of service.\nPlease see the following link for more information:\nhttps://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell\n","status":"published","published":"2021-12-15T19:02:14Z","modified":"2026-02-10T04:42:24Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}