{"id":"CVE-2021-44832","aliases":["DEBIAN-CVE-2021-44832","DLA-2870-1","EUVD-2022-0516","GHSA-8489-44mv-ggj8","MGASA-2022-0002","OESA-2021-1481","OESA-2022-1956","OESA-2022-1957","RHSA-2022:1296","RHSA-2022:1297","ROOT-APP-MAVEN-CVE-2021-44832","UBUNTU-CVE-2021-44832","USN-5222-1","openSUSE-SU-2021:4208-1","openSUSE-SU-2022:0002-1","openSUSE-SU-2024:11702-1"],"status":"published","title":"Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.97906,"percentile":0.99908,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-74"],"published":"2021-12-28T19:35:11Z","modified":"2026-11-06T13:49:16Z","exploits":[{"source":"pocgithub","id":"cckuailong/log4j_RCE_CVE-2021-44832","title":"cckuailong/log4j_RCE_CVE-2021-44832","date":"2021-12-29","url":"https://github.com/cckuailong/log4j_RCE_CVE-2021-44832"},{"source":"pocgithub","id":"name/log4j-scanner","title":"name/log4j-scanner","date":"2021-12-29","url":"https://github.com/name/log4j-scanner"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.3.2","2.12.4","2.17.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","fixed_in":["1.9.2","1.10.9","1.11.13","2.0.14"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"apache-log4j2","fixed_in":["2.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache-log4j2","fixed_in":["2.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache-log4j2","fixed_in":["2.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"apache-log4j2","fixed_in":["2.12.4-0+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"log4j","fixed_in":["2.17.1-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","fixed_in":["avalon-framework-4.3-25.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","fixed_in":["avalon-framework-4.3-25.oe1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","fixed_in":["2.17.0-root.io.11","2.17.0-root.io.12","2.12.4-root.io.1","2.12.4-root.io.2","2.12.4-root.io.3","2.12.4-root.io.9","2.12.4-root.io.10"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.12.4-aikido.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","fixed_in":["2.12.4-0ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","fixed_in":["2.17.1-0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"log4j","fixed_in":["2.17.0-4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"log4j","fixed_in":["2.17.0-lp152.3.15.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta7"},{"fixed":"2.3.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.12.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.17.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-0+deb9u1"}]}],"versions":["2.10.0-1","2.10.0-2","2.11.1-1","2.11.1-2","2.11.2-1","2.12.3-0+deb9u1","2.7-2","2.7-2+deb9u1","2.8.2-1","2.8.2-2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta7"},{"fixed":"2.3.2"}]}],"versions":["2.0","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.2","2.3","2.3.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.12.4"}]}],"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.17.1"}]}],"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}],"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.9"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.13"}]}],"versions":["1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"]},{"source":"osv","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.14"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Mageia:8","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"avalon-framework-4.3-25.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanucleus-api-jdo,avalon-framework,HikariCP,metrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"avalon-framework-4.3-25.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.0-4.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.0-3.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.1-1.redhat_00001.1.el7eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.1-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.0-root.io.11"},{"fixed":"2.17.0-root.io.12"},{"fixed":"2.12.4-root.io.1"},{"fixed":"2.12.4-root.io.2"},{"fixed":"2.12.4-root.io.3"},{"fixed":"2.12.4-root.io.9"},{"fixed":"2.12.4-root.io.10"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-aikido.10"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2-1","2.4-1","2.4-2","2.4-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-0ubuntu0.1"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2","2.10.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-0.20.04.1"}]}],"versions":["2.11.1-2","2.11.2-1","2.15.0-0.20.04.1","2.16.0-0.20.04.1","2.17.0-0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-0ubuntu0.1"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2","2.10.0-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-0.20.04.1"}]}],"versions":["2.11.1-2","2.11.2-1","2.15.0-0.20.04.1","2.16.0-0.20.04.1","2.17.0-0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.0-4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.0-lp152.3.15.1"}]}]}],"products":[{"vendor":"apache","product":"log4j"},{"vendor":"apache software foundation","product":"apache log4j2"},{"vendor":"cisco","product":"cloudcenter"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"communications_brm_-_elastic_charging_engine"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_interactive_session_recorder"},{"vendor":"oracle","product":"communications_offline_mediation_controller"},{"vendor":"oracle","product":"flexcube_private_banking"},{"vendor":"oracle","product":"health_sciences_data_management_workbench"},{"vendor":"oracle","product":"policy_automation"},{"vendor":"oracle","product":"policy_automation_for_mobile_devices"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"primavera_p6_enterprise_project_portfolio_management"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"product_lifecycle_analytics"},{"vendor":"oracle","product":"retail_assortment_planning"},{"vendor":"oracle","product":"retail_fiscal_management"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3293","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220104-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44832","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","tags":["web"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220104-0001","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8489-44mv-ggj8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44832","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0002.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29827","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/28/1","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QD3TW7GD6PF3ZSKL2TJG3Z462FFFLJND/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1481","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45105","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45046","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1296","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032580","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041967","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-22105","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22385","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22731","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22738","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22819","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22839","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22864","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22899","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22904","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22911","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22912","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22913","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22935","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22945","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22973","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23038","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23040","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23045","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23101","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23105","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23143","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23177","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23323","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23373","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23374","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23375","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1296.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4104","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2021-009","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4104","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","tags":["article"]},{"url":"https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301","tags":["article"]},{"url":"https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/13/1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44832","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44832","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45046","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44228","tags":["article"]},{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45105","tags":["advisory"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3230","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/19/1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23302","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23302","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23305","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23307","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/5","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1297","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-22900","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1297.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44832","tags":["report"]},{"url":"https://github.com/apache/logging-log4j2/commit/05db5f9527254632b59aed2a1d78a32c5ab74f16","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5222-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45105","tags":["report"]},{"url":"https://bugzilla.suse.com/1194127","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44832","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YBITTL424FAEN3BI2PM3NGBMPREUS3P4/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44832","title":"Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T19:35:11Z","modified":"2026-05-29T18:53:46.103Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2022-0516","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T19:35:11Z","modified":"2026-05-29T18:53:46Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T18:21:00.384456Z"}],"ghsa":[{"id":"GHSA-8489-44mv-ggj8","title":"Improper Input Validation and Injection in Apache Log4j2","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\nThis issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.","status":"published","published":"2022-01-04T16:14:20Z","modified":"2026-06-09T10:31:59Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2021-44832","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T20:15:08.4Z","modified":"2026-06-17T04:12:52.013Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"CVE-2021-44832","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T20:15:08.4Z","modified":"2026-10-24T10:30:39.180518152Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44832","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T20:15:08.4Z","modified":"2026-10-23T18:04:00.582408465Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-8489-44mv-ggj8","title":"Improper Input Validation and Injection in Apache Log4j2","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\nThis issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.","status":"published","published":"2022-01-04T16:14:20Z","modified":"2026-06-09T10:45:14.253296471Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"OESA-2021-1481","title":"log4j security update","description":"Log4j is a tool to help the programmer output log statements to a variety of output targets.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.(CVE-2021-44832)","status":"published","published":"2021-12-31T11:04:45Z","modified":"2026-08-18T01:16:16.809951318Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2022-1956","title":"log4j security update","description":"Log4j is a tool to help the programmer output log statements to a variety of output targets.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.(CVE-2021-45105)\r\n\r\nApache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.(CVE-2021-44832)","status":"published","published":"2022-09-23T11:05:16Z","modified":"2026-08-18T01:17:18.579101339Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1957","title":"log4j security update","description":"Log4j is a tool to help the programmer output log statements to a variety of output targets.\r\n\r\nSecurity Fix(es):\r\n\r\nIt was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.(CVE-2021-45046)\r\n\r\nApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.(CVE-2021-45105)\r\n\r\nApache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.(CVE-2021-44832)","status":"published","published":"2022-09-23T11:05:16Z","modified":"2026-08-18T01:17:18.604036552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:1296","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update","status":"published","published":"2024-09-29T19:09:38Z","modified":"2026-10-13T10:02:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1297","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update","status":"published","published":"2024-09-29T19:09:30Z","modified":"2026-10-13T10:02:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-44832","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","status":"published","published":"2021-12-28T20:15:00Z","modified":"2026-11-06T13:49:16.417073648Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-06T14:21:59.241576Z"},{"id":"DLA-2870-1","title":"apache-log4j2 - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:21:09.88603Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0002","title":"Updated log4j packages fix security vulnerability","description":"Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where\nan attacker with permission to modify the logging configuration file can\nconstruct a malicious configuration using a JDBC Appender with a data\nsource referencing a JNDI URI which can execute remote code. This issue is\nfixed by limiting JNDI data source names to the java protocol\n","status":"published","published":"2022-01-03T07:36:40Z","modified":"2026-04-16T04:43:39.32905254Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:4208-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\n- CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127)\n","status":"published","published":"2021-12-30T11:56:04Z","modified":"2026-02-04T03:35:12.159004Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0002-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\n- CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2022-01-02T17:01:06Z","modified":"2026-02-04T04:02:07.169981Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11702-1","title":"log4j-2.17.1-1.1 on GA media","description":"These are all security issues fixed in the log4j-2.17.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:30.647606Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"ROOT-APP-MAVEN-CVE-2021-44832","title":"CVE-2021-44832 in io.root.org.apache.logging.log4j:log4j-core - Patched by Root","description":"Root has patched CVE-2021-44832 in the io.root.org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-21T07:54:49Z","modified":"2026-06-21T13:00:08.788761278Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"USN-5222-1","title":"apache-log4j2 vulnerabilities","description":"It was discovered that Apache Log4j 2 was vulnerable to remote code\nexecution (RCE) attack when configured to use a JDBC Appender with a\nJNDI LDAP data source URI. A remote attacker could possibly use this issue to\ncause a crash, leading to a denial of service. (CVE-2021-44832)\n\nHideki Okamoto and Guy Lederfein discovered that Apache Log4j 2 did not\nprotect against infinite recursion in lookup evaluation. A remote attacker\ncould possibly use this issue to cause Apache Log4j 2 to crash, leading to\na denial of service. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2021-45105)\n","status":"published","published":"2022-01-11T20:42:28Z","modified":"2026-06-01T07:15:29.038688533Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}