CVE-2021-44228
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Apache Log4j2
PublishedDec 10, 2021
First seenDec 10, 2021
Added to KEVDec 10, 2021
How to fix
CISA required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
CISA due date: Dec 24, 2021Update
- apache log4j2.3.1, 2.12.2, 2.15.0 or later
- siemens 6bk1602-0aa12-0tp0_firmware2.7.0 or later
- siemens 6bk1602-0aa22-0tp0_firmware2.7.0 or later
- siemens 6bk1602-0aa32-0tp0_firmware2.7.0 or later
- siemens 6bk1602-0aa42-0tp0_firmware2.7.0 or later
- siemens 6bk1602-0aa52-0tp0_firmware2.7.0 or later
- siemens capital2019.1 or later
- siemens comos10.4.2 or later
- siemens e-car_operation_center2021-12-13 or later
- siemens energyip_prepay3.8.0.12 or later
- siemens gma-manager8.6.2j-398 or later
- siemens industrial_edge_management_hub2021-12-13 or later
Vendor advisories
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- debian.org/security/2021/dsa-5020
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
- msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache log4j | 2.0.1 ≤ v < 2.3.1, 2.4.0 ≤ v < 2.12.2, 2.13.0 ≤ v < 2.15.0, 2.0 | 2.3.1, 2.12.2, 2.15.0 |
| siemens 6bk1602-0aa12-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa22-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa32-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa42-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens 6bk1602-0aa52-0tp0_firmware | v < 2.7.0 | 2.7.0 |
| siemens sppa-t3000_ses3000_firmware | No range specified | — |
| siemens capital | v < 2019.1, 2019.1 | 2019.1 |
| siemens comos | v < 10.4.2 | 10.4.2 |
| siemens desigo_cc_advanced_reports | 3.0, 4.0, 4.1, 4.2, 5.0, 5.1 | — |
| siemens desigo_cc_info_center | 5.0, 5.1 | — |
| siemens e-car_operation_center | v < 2021-12-13 | 2021-12-13 |
| siemens energy_engage | 3.1 | — |
| siemens energyip | 8.5, 8.6, 8.7, 9.0 | — |
| siemens energyip_prepay | v < 3.8.0.12 | 3.8.0.12 |
| siemens gma-manager | v < 8.6.2j-398 | 8.6.2j-398 |
| siemens head-end_system_universal_device_integration_system | No range specified | — |
| siemens industrial_edge_management | No range specified | — |
| siemens industrial_edge_management_hub | v < 2021-12-13 | 2021-12-13 |
| siemens logo\!_soft_comfort | No range specified | — |
| siemens mendix | No range specified | — |
| siemens mindsphere | v < 2021-12-16 | 2021-12-16 |
| siemens navigator | v < 2021-12-13 | 2021-12-13 |
| siemens nx | No range specified | — |
| siemens opcenter_intelligence | 3.2 ≤ v < 3.5 | 3.5 |
| siemens operation_scheduler | v ≤ 1.1.3 | — |
| siemens sentron_powermanager | 4.1, 4.2 | — |
| siemens siguard_dsa | 4.2 ≤ v < 4.4.1 | 4.4.1 |
| siemens sipass_integrated | 2.80, 2.85 | — |
| siemens siveillance_command | v ≤ 4.16.2.1 | — |
| siemens siveillance_control_pro | No range specified | — |
| siemens siveillance_identity | 1.5, 1.6 | — |
| siemens siveillance_vantage | No range specified | — |
| siemens siveillance_viewpoint | No range specified | — |
| siemens solid_edge_cam_pro | No range specified | — |
| siemens solid_edge_harness_design | v < 2020, 2020 | 2020 |
| siemens spectrum_power_4 | v < 4.70, 4.70 | 4.70 |
| siemens spectrum_power_7 | v < 2.30, 2.30 | 2.30 |
| siemens teamcenter | No range specified | — |
| siemens vesys | v < 2019.1, 2019.1, 2020.1, 2021.1 | 2019.1 |
| siemens xpedition_enterprise | No range specified | — |
| siemens xpedition_package_integrator | No range specified | — |
| intel computer_vision_annotation_tool | No range specified | — |
| intel datacenter_manager | v < 5.1 | 5.1 |
| intel genomics_kernel_library | No range specified | — |
| intel oneapi_sample_browser | No range specified | — |
| intel secure_device_onboard | No range specified | — |
| intel system_studio | No range specified | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| fedoraproject fedora | 34, 35 | — |
| sonicwall email_security | v < 10.0.13 | 10.0.13 |
| netapp active_iq_unified_manager | No range specified | — |
| netapp brocade_san_navigator | No range specified | — |
| netapp cloud_insights | No range specified | — |
| netapp cloud_manager | No range specified | — |
| netapp cloud_secure_agent | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp ontap_tools | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp solidfire_\&_hci_storage_node | No range specified | — |
| netapp solidfire_enterprise_sds | No range specified | — |
| cisco advanced_malware_protection_virtual_private_cloud_appliance | v < 3.5.4 | 3.5.4 |
| cisco automated_subsea_tuning | v < 2.1.0 | 2.1.0 |
| cisco broadworks | v < 2021.11_1.162 | 2021.11_1.162 |
| cisco business_process_automation | v < 3.0.000.115, 3.1.000.000 ≤ v < 3.1.000.044, 3.2.000.000 ≤ v < 3.2.000.009 | 3.0.000.115, 3.1.000.044, 3.2.000.009 |
| cisco cloud_connect | v < 12.6\(1\) | 12.6\(1\) |
| cisco cloudcenter | v < 4.10.0.16 | 4.10.0.16 |
| cisco cloudcenter_cost_optimizer | v < 5.5.2 | 5.5.2 |
| cisco cloudcenter_suite_admin | v < 5.3.1 | 5.3.1 |
| cisco cloudcenter_workload_manager | v < 5.5.2 | 5.5.2 |
| cisco common_services_platform_collector | v < 2.9.1.3, 2.10.0 ≤ v < 2.10.0.1 | 2.9.1.3, 2.10.0.1 |
| cisco connected_mobile_experiences | No range specified | — |
| cisco contact_center_domain_manager | v < 12.5\(1\) | 12.5\(1\) |
| cisco contact_center_management_portal | v < 12.5\(1\) | 12.5\(1\) |
| cisco crosswork_data_gateway | v < 2.0.2, 3.0.0 | 2.0.2 |
| cisco crosswork_network_controller | v < 2.0.1, 3.0.0 | 2.0.1 |
| cisco crosswork_optimization_engine | v < 2.0.1, 3.0.0 | 2.0.1 |
| cisco crosswork_platform_infrastructure | v < 4.0.1, 4.1.0 | 4.0.1 |
| cisco crosswork_zero_touch_provisioning | v < 2.0.1, 3.0.0 | 2.0.1 |
| cisco customer_experience_cloud_agent | v < 1.12.1 | 1.12.1 |
| cisco cyber_vision_sensor_management_extension | v < 4.0.3 | 4.0.3 |
| cisco data_center_network_manager | v < 11.3\(1\), 11.3\(1\) | 11.3\(1\) |
| cisco dna_center | v < 2.1.2.8, 2.2.2.0 ≤ v < 2.2.2.8, 2.2.3.0 ≤ v < 2.2.3.4 | 2.1.2.8, 2.2.2.8, 2.2.3.4 |
| cisco dna_spaces\ | _connector ≤ v < 2.5 | 2.5 |
| cisco emergency_responder | v < 11.5\(4\) | 11.5\(4\) |
| cisco enterprise_chat_and_email | v < 12.0\(1\) | 12.0\(1\) |
| cisco evolved_programmable_network_manager | v ≤ 4.1.1 | — |
| cisco finesse | v < 12.6\(1\), 12.6\(1\) | 12.6\(1\) |
| cisco fog_director | No range specified | — |
| cisco identity_services_engine | v < 2.4.0, 2.4.0 | 2.4.0 |
| cisco integrated_management_controller_supervisor | v < 2.3.2.1 | 2.3.2.1 |
| cisco intersight_virtual_appliance | v < 1.0.9-361 | 1.0.9-361 |
| cisco iot_operations_dashboard | No range specified | — |
| cisco network_assurance_engine | v < 6.0.2 | 6.0.2 |
| cisco network_services_orchestrator | v < 5.3.5.1, 5.4 ≤ v < 5.4.5.2, 5.5 ≤ v < 5.5.4.1, 5.6 ≤ v < 5.6.3.1 | 5.3.5.1, 5.4.5.2, 5.5.4.1, 5.6.3.1 |
| cisco nexus_dashboard | v < 2.1.2 | 2.1.2 |
| cisco nexus_insights | v < 6.0.2 | 6.0.2 |
| cisco optical_network_controller | v < 1.1.0 | 1.1.0 |
| cisco packaged_contact_center_enterprise | v < 11.6, 11.6\(1\) | 11.6 |
| cisco paging_server | v < 14.4.1 | 14.4.1 |
| cisco prime_service_catalog | v < 12.1 | 12.1 |
| cisco sd-wan_vmanage | v < 20.3.4.1, 20.4 ≤ v < 20.4.2.1, 20.5 ≤ v < 20.5.1.1, 20.6 ≤ v < 20.6.2.1 | 20.3.4.1, 20.4.2.1, 20.5.1.1, 20.6.2.1 |
| cisco smart_phy | v < 3.2.1 | 3.2.1 |
| cisco ucs_central | v < 2.0\(1p\) | 2.0\(1p\) |
| cisco ucs_director | v < 6.8.2.0 | 6.8.2.0 |
| cisco unified_communications_manager | v < 11.5\(1\), 11.5\(1\), 11.5\(1\)su3 | 11.5\(1\) |
| cisco unified_communications_manager_im_and_presence_service | v < 11.5\(1\), 11.5\(1\) | 11.5\(1\) |
| cisco unified_contact_center_enterprise | v < 11.6\(2\), 11.6\(2\) | 11.6\(2\) |
| cisco unified_contact_center_express | v < 12.5\(1\) | 12.5\(1\) |
| cisco unified_customer_voice_portal | v < 11.6, 11.6, 12.0, 12.5 | 11.6 |
| cisco unified_intelligence_center | v < 12.6\(1\) | 12.6\(1\) |
| cisco unity_connection | v < 11.5\(1\) | 11.5\(1\) |
| cisco video_surveillance_operations_manager | v < 7.14.4 | 7.14.4 |
| cisco virtual_topology_system | v < 2.6.7 | 2.6.7 |
| cisco virtualized_infrastructure_manager | v < 3.2.0, 3.4.0 ≤ v < 3.4.4 | 3.2.0, 3.4.4 |
| cisco virtualized_voice_browser | v < 12.5\(1\) | 12.5\(1\) |
| cisco wan_automation_engine | v < 7.3.0.2 | 7.3.0.2 |
| cisco webex_meetings_server | v < 3.0, 3.0, 4.0 | 3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.