CVE-2021-44832
Medium
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
SeverityMedium
CVSS6.6
Exploit probability—
Product
Apache Log4j
PublishedDec 28, 2021
First seenDec 28, 2021
Weakness typeCWE-20Improper input validationCWE-74Injection
How to fix
Update
- apache log4j2.3.2, 2.12.4, 2.17.1 or later
- oracle communications_brm_-_elastic_charging_engine12.0.0.4.6 or later
- oracle communications_offline_mediation_controller12.0.0.4.4 or later
- org.apache.logging.log4j:log4j-core2.3.2, 2.12.4, 2.17.1 or later
- org.ops4j.pax.logging:pax-logging-log4j21.9.2, 1.10.9, 1.11.13, 2.0.14 or later
Vendor advisories
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache log4j | 2.0.1 ≤ v < 2.3.2, 2.4 ≤ v < 2.12.4, 2.13.0 ≤ v < 2.17.1, 2.0 | 2.3.2, 2.12.4, 2.17.1 |
| oracle communications_diameter_signaling_router | 8.0.0.0 ≤ v ≤ 8.5.1.0, 8.3.0.0 ≤ v ≤ 8.5.1.0 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle primavera_gateway | 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.13, 19.12.0 ≤ v ≤ 19.12.12, 20.12.0 ≤ v ≤ 20.12.7, 21.12.0 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 19.12.0 ≤ v ≤ 19.12.18.0, 20.12.0.0 ≤ v ≤ 20.12.12.0, 21.12.0.0, 19.12.0.0 ≤ v ≤ 19.12.18.0 | — |
| oracle primavera_unifier | 18.8, 19.12, 20.12, 21.12 | — |
| oracle retail_assortment_planning | 16.0.3 | — |
| oracle retail_fiscal_management | 14.2 | — |
| oracle siebel_ui_framework | 21.12, v ≤ 21.12 | — |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| cisco cloudcenter | 4.10.0.16 | — |
| fedoraproject fedora | 34, 35 | — |
| debian debian_linux | 9.0 | — |
| oracle communications_brm_-_elastic_charging_engine | v < 12.0.0.4.6, 12.0.0.5.0 | 12.0.0.4.6 |
| oracle communications_offline_mediation_controller | v < 12.0.0.4.4, 12.0.0.5.0 | 12.0.0.4.4 |
| oracle flexcube_private_banking | 12.1.0 | — |
| oracle health_sciences_data_management_workbench | 2.5.2.1, 3.0.0.0, 3.1.0.3 | — |
| oracle policy_automation | 12.2.0 ≤ v ≤ 12.2.24 | — |
| oracle policy_automation_for_mobile_devices | 12.2.0 ≤ v ≤ 12.2.24 | — |
| oracle product_lifecycle_analytics | 3.6.1 | — |
| oracle retail_order_broker | 18.0, 19.1 | — |
| oracle retail_xstore_point_of_service | 17.0.4, 18.0.3, 19.0.2, 20.0.1, 21.0.1 | — |
| org.apache.logging.log4j:log4j-coreMaven | 2.0-beta7 ≤ v < 2.3.2, 2.4 ≤ v < 2.12.4, 2.13.0 ≤ v < 2.17.1 | 2.3.2, 2.12.4, 2.17.1 |
| org.ops4j.pax.logging:pax-logging-log4j2Maven | 1.8.0 ≤ v < 1.9.2, 1.10.0 ≤ v < 1.10.9, 1.11.0 ≤ v < 1.11.13, 2.0.0 ≤ v < 2.0.14 | 1.9.2, 1.10.9, 1.11.13, 2.0.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.