First published: Fri Dec 10 2021(Updated: )
# Summary Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default. Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory. # Impact Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. # Affected versions Any Log4J version prior to v2.15.0 is affected to this specific issue. The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible. ## Security releases Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3 ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Remediation Advice ## Updated advice for version 2.16.0 The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0). Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33). Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221). Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.
Credit: CVE-2019-14379 CVE-2021-44228 security@apache.org security@apache.org security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
debian/apache-log4j1.2 | 1.2.17-8+deb10u2 1.2.17-8+deb10u1 1.2.17-10+deb11u1 1.2.17-11 | |
debian/apache-log4j2 | 2.17.1-1~deb10u1 2.17.0-1~deb10u1 2.17.1-1~deb11u1 2.17.0-1~deb11u1 2.19.0-2 | |
debian/apache-log4j2 | <=2.13.3-1<=2.7-2<=2.11.1-2 | 2.15.0-1 2.15.0-1~deb11u1 2.15.0-1~deb10u1 |
Apple Xcode | <13.3 | 13.3 |
redhat/log4j | <2.15.0 | 2.15.0 |
Apache Log4j | >=2.0.1<2.3.1 | |
Apache Log4j | >=2.4.0<2.12.2 | |
Apache Log4j | >=2.13.0<2.15.0 | |
Apache Log4j | =2.0 | |
Apache Log4j | =2.0-beta9 | |
Apache Log4j | =2.0-rc1 | |
Apache Log4j | =2.0-rc2 | |
Siemens Sppa-t3000 Ses3000 Firmware | ||
Siemens Sppa-t3000 Ses3000 | ||
Siemens Captial | <2019.1 | |
Siemens Captial | =2019.1 | |
Siemens Captial | =2019.1-sp1912 | |
Siemens COMOS | ||
Siemens Desigo Cc Advanced Reports | =4.0 | |
Siemens Desigo Cc Advanced Reports | =4.1 | |
Siemens Desigo Cc Advanced Reports | =4.2 | |
Siemens Desigo Cc Advanced Reports | =5.0 | |
Siemens Desigo Cc Advanced Reports | =5.1 | |
Siemens Desigo Cc Info Center | =5.0 | |
Siemens Desigo Cc Info Center | =5.1 | |
Siemens E-car Operation Center | <2021-12-13 | |
Siemens Energy Engage | =3.1 | |
Siemens Energyip | =8.5 | |
Siemens Energyip | =8.6 | |
Siemens Energyip | =8.7 | |
Siemens Energyip | =9.0 | |
Siemens Energyip Prepay | =3.7 | |
Siemens Energyip Prepay | =3.8 | |
Siemens Gma-manager | <8.6.2j-398 | |
Siemens Head-end System Universal Device Integration System | ||
Siemens Industrial Edge Management | ||
Siemens Industrial Edge Management Hub | <2021-12-13 | |
Siemens Logo\! Soft Comfort | ||
Siemens Mendix | ||
Siemens Mindsphere | <2021-12-11 | |
Siemens Navigator | <2021-12-13 | |
Siemens Nx | ||
Siemens Opcenter Intelligence | <=3.2 | |
Siemens Operation Scheduler | <=1.1.3 | |
Siemens Sentron Powermanager | =4.1 | |
Siemens Sentron Powermanager | =4.2 | |
Siemens Siguard Dsa | =4.2 | |
Siemens Siguard Dsa | =4.3 | |
Siemens Siguard Dsa | =4.4 | |
Siemens SiPass integrated | =2.80 | |
Siemens SiPass integrated | =2.85 | |
Siemens Siveillance Command | <=4.16.2.1 | |
Siemens Siveillance Control Pro | ||
Siemens Siveillance Identity | =1.5 | |
Siemens Siveillance Identity | =1.6 | |
Siemens Siveillance Vantage | ||
Siemens Siveillance Viewpoint | ||
Siemens Solid Edge Cam Pro | ||
Siemens Solid Edge Harness Design | <2020 | |
Siemens Solid Edge Harness Design | =2020 | |
Siemens Solid Edge Harness Design | =2020 | |
Siemens Solid Edge Harness Design | =2020-sp2002 | |
Siemens Spectrum Power 4 | <4.70 | |
Siemens Spectrum Power 4 | =4.70 | |
Siemens Spectrum Power 4 | =4.70-sp7 | |
Siemens Spectrum Power 4 | =4.70-sp8 | |
Siemens Spectrum Power 7 | <2.30 | |
Siemens Spectrum Power 7 | =2.30 | |
Siemens Spectrum Power 7 | =2.30 | |
Siemens Spectrum Power 7 | =2.30-sp2 | |
Siemens Teamcenter | ||
Siemens Vesys | <2019.1 | |
Siemens Vesys | =2019.1 | |
Siemens Vesys | =2019.1 | |
Siemens Vesys | =2019.1-sp1912 | |
Siemens Xpedition Enterprise | ||
Siemens Xpedition Package Integrator | ||
Intel Audio Development Kit | ||
Intel Computer Vision Annotation Tool | ||
Intel Data Center Manager | <5.1 | |
Intel Genomics Kernel Library | ||
Intel Oneapi Sample Browser Eclipse | ||
Intel Secure Device Onboard | ||
Intel Sensor Solution Firmware Development Kit | ||
Intel System Debugger | ||
Intel System Studio | ||
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Debian Debian Linux | =11.0 | |
Fedoraproject Fedora | =34 | |
Fedoraproject Fedora | =35 | |
SonicWall Email Security | <10.0.12 | |
Netapp Active Iq Unified Manager Linux | ||
Netapp Active Iq Unified Manager Vmware Vsphere | ||
Netapp Active Iq Unified Manager Windows | ||
Netapp Cloud Insights | ||
NetApp Cloud Manager | ||
Netapp Cloud Secure Agent | ||
NetApp OnCommand Insight | ||
Netapp Ontap Tools Vmware Vsphere | ||
Netapp Snapcenter Vmware Vsphere | ||
Cisco Advanced Malware Protection Virtual Private Cloud Appliance | <3.5.4 | |
Cisco Automated Subsea Tuning | <2.1.0 | |
Cisco BroadWorks | <2021.11_1.162 | |
Cisco Business Process Automation | <3.0.000.115 | |
Cisco Business Process Automation | >=3.1.000.000<3.1.000.044 | |
Cisco Business Process Automation | >=3.2.000.000<3.2.000.009 | |
Cisco Cloud Connect | <12.6\(1\) | |
Cisco Cloudcenter | <4.10.0.16 | |
Cisco Cloudcenter Cost Optimizer | <5.5.2 | |
Cisco Cloudcenter Suite Admin | <5.3.1 | |
Cisco Cloudcenter Workload Manager | <5.5.2 | |
Cisco Common Services Platform Collector | <2.9.1.3 | |
Cisco Common Services Platform Collector | >=2.10.0<2.10.0.1 | |
Cisco Connected Mobile Experiences | ||
Cisco Contact Center Domain Manager | <12.5\(1\) | |
Cisco Contact Center Management Portal | <12.5\(1\) | |
Cisco Crosswork Data Gateway | <2.0.2 | |
Cisco Crosswork Data Gateway | =3.0.0 | |
Cisco Crosswork Network Controller | <2.0.1 | |
Cisco Crosswork Network Controller | =3.0.0 | |
Cisco Crosswork Optimization Engine | <2.0.1 | |
Cisco Crosswork Optimization Engine | =3.0.0 | |
Cisco Crosswork Platform Infrastructure | <4.0.1 | |
Cisco Crosswork Platform Infrastructure | =4.1.0 | |
Cisco Crosswork Zero Touch Provisioning | <2.0.1 | |
Cisco Crosswork Zero Touch Provisioning | =3.0.0 | |
Cisco Customer Experience Cloud Agent | <1.12.1 | |
Cisco Cyber Vision Sensor Management Extension | <4.0.3 | |
Cisco Data Center Network Manager | <11.3\(1\) | |
Cisco Data Center Network Manager | =11.3\(1\) | |
Cisco DNA Center | <2.1.2.8 | |
Cisco DNA Center | >=2.2.2.0<2.2.2.8 | |
Cisco DNA Center | >=2.2.3.0<2.2.3.4 | |
Cisco Dna Spaces\ | <2.5 | |
Cisco Emergency Responder | <11.5\(4\) | |
Cisco Enterprise Chat and Email | <12.0\(1\) | |
Cisco Evolved Programmable Network Manager | <=4.1.1 | |
Cisco Finesse | <12.6\(1\) | |
Cisco Finesse | =12.6\(1\) | |
Cisco Fog Director | ||
Cisco Identity Services Engine | <2.4.0 | |
Cisco Identity Services Engine | =2.4.0 | |
Cisco Integrated Management Controller Supervisor | <2.3.2.1 | |
Cisco Intersight Virtual Appliance | <1.0.9-361 | |
Cisco Iot Operations Dashboard | ||
Cisco Network Assurance Engine | <6.0.2 | |
Cisco Network Services Orchestrator | <5.3.5.1 | |
Cisco Network Services Orchestrator | >=5.4<5.4.5.2 | |
Cisco Network Services Orchestrator | >=5.5<5.5.4.1 | |
Cisco Network Services Orchestrator | >=5.6<5.6.3.1 | |
Cisco Nexus Dashboard | <2.1.2 | |
Cisco Nexus Insights | <6.0.2 | |
Cisco Optical Network Controller | <1.1.0 | |
Cisco Packaged Contact Center Enterprise | <11.6 | |
Cisco Packaged Contact Center Enterprise | =11.6\(1\) | |
Cisco Paging Server | <14.4.1 | |
Cisco Prime Service Catalog | <12.1 | |
Cisco SD-WAN vManage | <20.3.4.1 | |
Cisco SD-WAN vManage | >=20.4<20.4.2.1 | |
Cisco SD-WAN vManage | >=20.5<20.5.1.1 | |
Cisco SD-WAN vManage | >=20.6<20.6.2.1 | |
Cisco Smart Phy | <3.2.1 | |
Cisco Ucs Central | <2.0\(1p\) | |
Cisco UCS Director | <6.8.2.0 | |
Cisco Unified Communications Manager | <11.5\(1\) | |
Cisco Unified Communications Manager | <11.5\(1\) | |
Cisco Unified Communications Manager | =11.5\(1\) | |
Cisco Unified Communications Manager | =11.5\(1\) | |
Cisco Unified Communications Manager | =11.5\(1\) | |
Cisco Unified Communications Manager | =11.5\(1\)su3 | |
Cisco Unified Communications Manager IM and Presence Service | <11.5\(1\) | |
Cisco Unified Communications Manager IM and Presence Service | =11.5\(1\) | |
Cisco Unified Contact Center Enterprise | <11.6\(2\) | |
Cisco Unified Contact Center Enterprise | =11.6\(2\) | |
Cisco Unified Contact Center Express | <12.5\(1\) | |
Cisco Unified Customer Voice Portal | <11.6 | |
Cisco Unified Customer Voice Portal | =11.6 | |
Cisco Unified Customer Voice Portal | =12.0 | |
Cisco Unified Customer Voice Portal | =12.5 | |
Cisco Unity Connection | <11.5\(1\) | |
Cisco Video Surveillance Operations Manager | <7.14.4 | |
Cisco Virtual Topology System | <2.6.7 | |
Cisco Virtualized Infrastructure Manager | <3.2.0 | |
Cisco Virtualized Infrastructure Manager | >=3.4.0<3.4.4 | |
Cisco Virtualized Voice Browser | <12.5\(1\) | |
Cisco Wan Automation Engine | <7.3.0.2 | |
Cisco WebEx Meetings Server | <3.0 | |
Cisco WebEx Meetings Server | =3.0 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release1 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release2 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3_security_patch4 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3_security_patch5 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3_service_pack_2 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release3_service_pack_3 | |
Cisco WebEx Meetings Server | =3.0-maintenance_release4 | |
Cisco WebEx Meetings Server | =4.0 | |
Cisco WebEx Meetings Server | =4.0-maintenance_release1 | |
Cisco WebEx Meetings Server | =4.0-maintenance_release2 | |
Cisco WebEx Meetings Server | =4.0-maintenance_release3 | |
Cisco Workload Optimization Manager | <3.2.1 | |
Cisco Unified Intelligence Center | <12.6\(1\) | |
Cisco Unified Sip Proxy | <10.2.1v2 | |
Cisco Unified Workforce Optimization | <11.5\(1\) | |
Cisco FXOS | =6.2.3 | |
Cisco FXOS | =6.3.0 | |
Cisco FXOS | =6.4.0 | |
Cisco FXOS | =6.5.0 | |
Cisco FXOS | =6.6.0 | |
Cisco FXOS | =6.7.0 | |
Cisco FXOS | =7.0.0 | |
Cisco FXOS | =7.1.0 | |
Cisco Firepower 1010 | ||
Cisco Firepower 1120 | ||
Cisco Firepower 1140 | ||
Cisco Firepower 1150 | ||
Cisco Firepower 2110 | ||
Cisco Firepower 2120 | ||
Cisco Firepower 2130 | ||
Cisco Firepower 2140 | ||
Cisco Firepower 4110 | ||
Cisco Firepower 4112 | ||
Cisco Firepower 4115 | ||
Cisco Firepower 4120 | ||
Cisco Firepower 4125 | ||
Cisco Firepower 4140 | ||
Cisco Firepower 4145 | ||
Cisco Firepower 4150 | ||
Cisco Firepower 9300 | ||
Cisco Automated Subsea Tuning | =02.01.00 | |
Cisco BroadWorks | ||
Cisco Cloudcenter Suite | =4.10\(0.15\) | |
Cisco Cloudcenter Suite | =5.3\(0\) | |
Cisco Cloudcenter Suite | =5.4\(1\) | |
Cisco Cloudcenter Suite | =5.5\(0\) | |
Cisco Cloudcenter Suite | =5.5\(1\) | |
Cisco Common Services Platform Collector | =002.009\(000.000\) | |
Cisco Common Services Platform Collector | =002.009\(000.001\) | |
Cisco Common Services Platform Collector | =002.009\(000.002\) | |
Cisco Common Services Platform Collector | =002.009\(001.000\) | |
Cisco Common Services Platform Collector | =002.009\(001.001\) | |
Cisco Common Services Platform Collector | =002.009\(001.002\) | |
Cisco Common Services Platform Collector | =002.010\(000.000\) | |
Cisco Connected Analytics For Network Deployment | =006.004.000.003 | |
Cisco Connected Analytics For Network Deployment | =006.005.000. | |
Cisco Connected Analytics For Network Deployment | =006.005.000.000 | |
Cisco Connected Analytics For Network Deployment | =007.000.001 | |
Cisco Connected Analytics For Network Deployment | =007.001.000 | |
Cisco Connected Analytics For Network Deployment | =007.002.000 | |
Cisco Connected Analytics For Network Deployment | =7.3 | |
Cisco Connected Analytics For Network Deployment | =007.003.000 | |
Cisco Connected Analytics For Network Deployment | =007.003.001.001 | |
Cisco Connected Analytics For Network Deployment | =007.003.003 | |
Cisco Connected Analytics For Network Deployment | =008.000.000 | |
Cisco Connected Analytics For Network Deployment | =008.000.000.000.004 | |
Cisco Crosswork Network Automation | ||
Cisco Crosswork Network Automation | =2.0.0 | |
Cisco Crosswork Network Automation | =3.0.0 | |
Cisco Crosswork Network Automation | =4.1.0 | |
Cisco Crosswork Network Automation | =4.1.1 | |
Cisco CX Cloud Agent | =001.012 | |
Cisco Cyber Vision | =4.0.2 | |
Cisco Cyber Vision Sensor Management Extension | =4.0.2 | |
Cisco DNA Center | =2.2.2.8 | |
Cisco Dna Spaces | ||
Cisco Dna Spaces Connector | ||
Cisco Emergency Responder | =11.5 | |
Cisco Emergency Responder | =11.5\(4.65000.14\) | |
Cisco Emergency Responder | =11.5\(4.66000.14\) | |
Cisco Enterprise Chat and Email | =12.0\(1\) | |
Cisco Enterprise Chat and Email | =12.5\(1\) | |
Cisco Enterprise Chat and Email | =12.6\(1\) | |
Cisco Evolved Programmable Network Manager | =3.0 | |
Cisco Evolved Programmable Network Manager | =3.1 | |
Cisco Evolved Programmable Network Manager | =4.0 | |
Cisco Evolved Programmable Network Manager | =4.1 | |
Cisco Evolved Programmable Network Manager | =5.0 | |
Cisco Evolved Programmable Network Manager | =5.1 | |
Cisco Finesse | =12.5\(1\)-su1 | |
Cisco Finesse | =12.5\(1\)-su2 | |
Cisco Finesse | =12.6\(1\) | |
Cisco Finesse | =12.6\(1\)-es01 | |
Cisco Finesse | =12.6\(1\)-es02 | |
Cisco Finesse | =12.6\(1\)-es03 | |
Cisco Firepower Threat Defense | =6.2.3 | |
Cisco Firepower Threat Defense | =6.3.0 | |
Cisco Firepower Threat Defense | =6.4.0 | |
Cisco Firepower Threat Defense | =6.5.0 | |
Cisco Firepower Threat Defense | =6.6.0 | |
Cisco Firepower Threat Defense | =6.7.0 | |
Cisco Firepower Threat Defense | =7.0.0 | |
Cisco Firepower Threat Defense | =7.1.0 | |
Cisco Identity Services Engine | =002.004\(000.914\) | |
Cisco Identity Services Engine | =002.006\(000.156\) | |
Cisco Identity Services Engine | =002.007\(000.356\) | |
Cisco Identity Services Engine | =003.000\(000.458\) | |
Cisco Identity Services Engine | =003.001\(000.518\) | |
Cisco Identity Services Engine | =003.002\(000.116\) | |
Cisco Integrated Management Controller Supervisor | =002.003\(002.000\) | |
Cisco Integrated Management Controller Supervisor | =2.3.2.0 | |
Cisco Intersight Virtual Appliance | =1.0.9-343 | |
Cisco Mobility Services Engine | ||
Cisco Network Assurance Engine | =6.0\(2.1912\) | |
Cisco Network Dashboard Fabric Controller | =11.0\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.1\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.2\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.3\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.4\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.5\(1\) | |
Cisco Network Dashboard Fabric Controller | =11.5\(2\) | |
Cisco Network Dashboard Fabric Controller | =11.5\(3\) | |
Cisco Network Insights For Data Center | =6.0\(2.1914\) | |
Cisco Network Services Orchestrator | ||
Cisco Optical Network Controller | =1.1 | |
Cisco Paging Server | =8.3\(1\) | |
Cisco Paging Server | =8.4\(1\) | |
Cisco Paging Server | =8.5\(1\) | |
Cisco Paging Server | =9.0\(1\) | |
Cisco Paging Server | =9.0\(2\) | |
Cisco Paging Server | =9.1\(1\) | |
Cisco Paging Server | =12.5\(2\) | |
Cisco Paging Server | =14.0\(1\) | |
Cisco Prime Service Catalog | =12.1 | |
Cisco SD-WAN vManage | =20.3 | |
Cisco SD-WAN vManage | =20.4 | |
Cisco SD-WAN vManage | =20.5 | |
Cisco SD-WAN vManage | =20.6 | |
Cisco SD-WAN vManage | =20.6.1 | |
Cisco SD-WAN vManage | =20.7 | |
Cisco SD-WAN vManage | =20.8 | |
Cisco Smart Phy | =3.1.2 | |
Cisco Smart Phy | =3.1.3 | |
Cisco Smart Phy | =3.1.4 | |
Cisco Smart Phy | =3.1.5 | |
Cisco Smart Phy | =3.2.1 | |
Cisco Smart Phy | =21.3 | |
Cisco Ucs Central Software | =2.0 | |
Cisco Ucs Central Software | =2.0\(1a\) | |
Cisco Ucs Central Software | =2.0\(1b\) | |
Cisco Ucs Central Software | =2.0\(1c\) | |
Cisco Ucs Central Software | =2.0\(1d\) | |
Cisco Ucs Central Software | =2.0\(1e\) | |
Cisco Ucs Central Software | =2.0\(1f\) | |
Cisco Ucs Central Software | =2.0\(1g\) | |
Cisco Ucs Central Software | =2.0\(1h\) | |
Cisco Ucs Central Software | =2.0\(1k\) | |
Cisco Ucs Central Software | =2.0\(1l\) | |
Cisco Unified Communications Manager | =11.5\(1.17900.52\) | |
Cisco Unified Communications Manager | =11.5\(1.18119.2\) | |
Cisco Unified Communications Manager | =11.5\(1.18900.97\) | |
Cisco Unified Communications Manager | =11.5\(1.21900.40\) | |
Cisco Unified Communications Manager | =11.5\(1.22900.28\) | |
Cisco Unified Communications Manager Im \& Presence Service | =11.5\(1\) | |
Cisco Unified Communications Manager Im \& Presence Service | =11.5\(1.22900.6\) | |
Cisco Unified Computing System | =006.008\(001.000\) | |
Cisco Unified Contact Center Enterprise | =12.0\(1\) | |
Cisco Unified Contact Center Enterprise | =12.5\(1\) | |
Cisco Unified Contact Center Enterprise | =12.6\(1\) | |
Cisco Unified Contact Center Enterprise | =12.6\(2\) | |
Cisco Unified Contact Center Express | =12.5\(1\) | |
Cisco Unified Contact Center Express | =12.5\(1\)-su1 | |
Cisco Unified Contact Center Express | =12.6\(1\) | |
Cisco Unified Contact Center Express | =12.6\(2\) | |
Cisco Unified Contact Center Management Portal | =12.6\(1\) | |
Cisco Unified Customer Voice Portal | =11.6\(1\) | |
Cisco Unified Customer Voice Portal | =12.0\(1\) | |
Cisco Unified Customer Voice Portal | =12.5\(1\) | |
Cisco Unified Customer Voice Portal | =12.6\(1\) | |
Cisco Unified Intelligence Center | =12.6\(1\) | |
Cisco Unified Intelligence Center | =12.6\(1\)-es01 | |
Cisco Unified Intelligence Center | =12.6\(1\)-es02 | |
Cisco Unified Intelligence Center | =12.6\(2\) | |
Cisco Unified Sip Proxy | =010.000\(000\) | |
Cisco Unified Sip Proxy | =010.000\(001\) | |
Cisco Unified Sip Proxy | =010.002\(000\) | |
Cisco Unified Sip Proxy | =010.002\(001\) | |
Cisco Unified Workforce Optimization | =11.5\(1\)-sr7 | |
Cisco Unity Connection | =11.5 | |
Cisco Unity Connection | =11.5\(1.10000.6\) | |
Cisco Video Surveillance Manager | =7.14\(1.26\) | |
Cisco Video Surveillance Manager | =7.14\(2.26\) | |
Cisco Video Surveillance Manager | =7.14\(3.025\) | |
Cisco Video Surveillance Manager | =7.14\(4.018\) | |
Cisco Virtual Topology System | =2.6.6 | |
Cisco Wan Automation Engine | =7.1.3 | |
Cisco Wan Automation Engine | =7.2.1 | |
Cisco Wan Automation Engine | =7.2.2 | |
Cisco Wan Automation Engine | =7.2.3 | |
Cisco Wan Automation Engine | =7.3 | |
Cisco Wan Automation Engine | =7.4 | |
Cisco Wan Automation Engine | =7.5 | |
Cisco Wan Automation Engine | =7.6 | |
Cisco WebEx Meetings Server | =3.0 | |
Cisco WebEx Meetings Server | =4.0 | |
Snowsoftware Snow Commander | <8.10.0 | |
Snowsoftware Vm Access Proxy | <3.6 | |
Bentley Synchro | >=6.1<6.4.3.2 | |
Bentley Synchro 4d | <6.2.4.2 | |
Percussion Rhythmyx | <=7.3.2 | |
maven/org.apache.logging.log4j:log4j-core | >=2.0-beta9<2.3.1 | 2.3.1 |
maven/uk.co.nichesolutions.logging.log4j:log4j-core | =2.6.3-CUSTOM | |
maven/org.xbib.elasticsearch:log4j | =6.3.2.1 | |
maven/com.guicedee.services:log4j-core | <=1.2.1.2-jre17 | |
maven/org.apache.logging.log4j:log4j-core | >=2.4<2.12.2 | 2.12.2 |
maven/org.apache.logging.log4j:log4j-core | >=2.13.0<2.15.0 | 2.15.0 |
Apache Log4j2 | ||
All of | ||
Siemens Sppa-t3000 Ses3000 Firmware | ||
Siemens Sppa-t3000 Ses3000 | ||
All of | ||
Any of | ||
Cisco Firepower 1010 | ||
Cisco Firepower 1120 | ||
Cisco Firepower 1140 | ||
Cisco Firepower 1150 | ||
Cisco Firepower 2110 | ||
Cisco Firepower 2120 | ||
Cisco Firepower 2130 | ||
Cisco Firepower 2140 | ||
Cisco Firepower 4110 | ||
Cisco Firepower 4112 | ||
Cisco Firepower 4115 | ||
Cisco Firepower 4120 | ||
Cisco Firepower 4125 | ||
Cisco Firepower 4140 | ||
Cisco Firepower 4145 | ||
Cisco Firepower 4150 | ||
Cisco Firepower 9300 | ||
Any of | ||
Cisco FXOS | =6.2.3 | |
Cisco FXOS | =6.3.0 | |
Cisco FXOS | =6.4.0 | |
Cisco FXOS | =6.5.0 | |
Cisco FXOS | =6.6.0 | |
Cisco FXOS | =6.7.0 | |
Cisco FXOS | =7.0.0 | |
Cisco FXOS | =7.1.0 | |
Apple Xcode | <13.3 | |
>=2.0.1<2.3.1 | ||
>=2.4.0<2.12.2 | ||
>=2.13.0<2.15.0 | ||
=2.0 | ||
=2.0-beta9 | ||
=2.0-rc1 | ||
=2.0-rc2 | ||
All of | ||
<2019.1 | ||
=2019.1 | ||
=2019.1-sp1912 | ||
=4.0 | ||
=4.1 | ||
=4.2 | ||
=5.0 | ||
=5.1 | ||
=5.0 | ||
=5.1 | ||
<2021-12-13 | ||
=3.1 | ||
=8.5 | ||
=8.6 | ||
=8.7 | ||
=9.0 | ||
=3.7 | ||
=3.8 | ||
<8.6.2j-398 | ||
<2021-12-13 | ||
<2021-12-11 | ||
<2021-12-13 | ||
<=3.2 | ||
<=1.1.3 | ||
=4.1 | ||
=4.2 | ||
=4.2 | ||
=4.3 | ||
=4.4 | ||
=2.80 | ||
=2.85 | ||
<=4.16.2.1 | ||
=1.5 | ||
=1.6 | ||
<2020 | ||
=2020 | ||
=2020 | ||
=2020-sp2002 | ||
<4.70 | ||
=4.70 | ||
=4.70-sp7 | ||
=4.70-sp8 | ||
<2.30 | ||
=2.30 | ||
=2.30 | ||
=2.30-sp2 | ||
<2019.1 | ||
=2019.1 | ||
=2019.1 | ||
=2019.1-sp1912 | ||
<5.1 | ||
=9.0 | ||
=10.0 | ||
=11.0 | ||
=34 | ||
=35 | ||
<10.0.12 | ||
<3.5.4 | ||
<2.1.0 | ||
<2021.11_1.162 | ||
<3.0.000.115 | ||
>=3.1.000.000<3.1.000.044 | ||
>=3.2.000.000<3.2.000.009 | ||
<12.6\(1\) | ||
<4.10.0.16 | ||
<5.5.2 | ||
<5.3.1 | ||
<5.5.2 | ||
<2.9.1.3 | ||
>=2.10.0<2.10.0.1 | ||
<12.5\(1\) | ||
<12.5\(1\) | ||
<2.0.2 | ||
=3.0.0 | ||
<2.0.1 | ||
=3.0.0 | ||
<2.0.1 | ||
=3.0.0 | ||
<4.0.1 | ||
=4.1.0 | ||
<2.0.1 | ||
=3.0.0 | ||
<1.12.1 | ||
<4.0.3 | ||
<11.3\(1\) | ||
=11.3\(1\) | ||
<2.1.2.8 | ||
>=2.2.2.0<2.2.2.8 | ||
>=2.2.3.0<2.2.3.4 | ||
<2.5 | ||
<11.5\(4\) | ||
<12.0\(1\) | ||
<=4.1.1 | ||
<12.6\(1\) | ||
=12.6\(1\) | ||
<2.4.0 | ||
=2.4.0 | ||
<2.3.2.1 | ||
<1.0.9-361 | ||
<6.0.2 | ||
<5.3.5.1 | ||
>=5.4<5.4.5.2 | ||
>=5.5<5.5.4.1 | ||
>=5.6<5.6.3.1 | ||
<2.1.2 | ||
<6.0.2 | ||
<1.1.0 | ||
<11.6 | ||
=11.6\(1\) | ||
<14.4.1 | ||
<12.1 | ||
<20.3.4.1 | ||
>=20.4<20.4.2.1 | ||
>=20.5<20.5.1.1 | ||
>=20.6<20.6.2.1 | ||
<3.2.1 | ||
<2.0\(1p\) | ||
<6.8.2.0 | ||
<11.5\(1\) | ||
<11.5\(1\) | ||
=11.5\(1\) | ||
=11.5\(1\) | ||
=11.5\(1\) | ||
=11.5\(1\)su3 | ||
<11.5\(1\) | ||
=11.5\(1\) | ||
<11.6\(2\) | ||
=11.6\(2\) | ||
<12.5\(1\) | ||
<11.6 | ||
=11.6 | ||
=12.0 | ||
=12.5 | ||
<11.5\(1\) | ||
<7.14.4 | ||
<2.6.7 | ||
<3.2.0 | ||
>=3.4.0<3.4.4 | ||
<12.5\(1\) | ||
<7.3.0.2 | ||
<3.0 | ||
=3.0 | ||
=3.0-maintenance_release1 | ||
=3.0-maintenance_release2 | ||
=3.0-maintenance_release3 | ||
=3.0-maintenance_release3 | ||
=3.0-maintenance_release3_security_patch4 | ||
=3.0-maintenance_release3_security_patch5 | ||
=3.0-maintenance_release3_service_pack_2 | ||
=3.0-maintenance_release3_service_pack_3 | ||
=3.0-maintenance_release4 | ||
=4.0 | ||
=4.0-maintenance_release1 | ||
=4.0-maintenance_release2 | ||
=4.0-maintenance_release3 | ||
<3.2.1 | ||
<12.6\(1\) | ||
<10.2.1v2 | ||
<11.5\(1\) | ||
All of | ||
Any of | ||
Any of | ||
=6.2.3 | ||
=6.3.0 | ||
=6.4.0 | ||
=6.5.0 | ||
=6.6.0 | ||
=6.7.0 | ||
=7.0.0 | ||
=7.1.0 | ||
=02.01.00 | ||
=4.10\(0.15\) | ||
=5.3\(0\) | ||
=5.4\(1\) | ||
=5.5\(0\) | ||
=5.5\(1\) | ||
=002.009\(000.000\) | ||
=002.009\(000.001\) | ||
=002.009\(000.002\) | ||
=002.009\(001.000\) | ||
=002.009\(001.001\) | ||
=002.009\(001.002\) | ||
=002.010\(000.000\) | ||
=006.004.000.003 | ||
=006.005.000. | ||
=006.005.000.000 | ||
=007.000.001 | ||
=007.001.000 | ||
=007.002.000 | ||
=7.3 | ||
=007.003.000 | ||
=007.003.001.001 | ||
=007.003.003 | ||
=008.000.000 | ||
=008.000.000.000.004 | ||
=2.0.0 | ||
=3.0.0 | ||
=4.1.0 | ||
=4.1.1 | ||
=001.012 | ||
=4.0.2 | ||
=4.0.2 | ||
=2.2.2.8 | ||
=11.5 | ||
=11.5\(4.65000.14\) | ||
=11.5\(4.66000.14\) | ||
=12.0\(1\) | ||
=12.5\(1\) | ||
=12.6\(1\) | ||
=3.0 | ||
=3.1 | ||
=4.0 | ||
=4.1 | ||
=5.0 | ||
=5.1 | ||
=12.5\(1\)-su1 | ||
=12.5\(1\)-su2 | ||
=12.6\(1\) | ||
=12.6\(1\)-es01 | ||
=12.6\(1\)-es02 | ||
=12.6\(1\)-es03 | ||
=6.2.3 | ||
=6.3.0 | ||
=6.4.0 | ||
=6.5.0 | ||
=6.6.0 | ||
=6.7.0 | ||
=7.0.0 | ||
=7.1.0 | ||
=002.004\(000.914\) | ||
=002.006\(000.156\) | ||
=002.007\(000.356\) | ||
=003.000\(000.458\) | ||
=003.001\(000.518\) | ||
=003.002\(000.116\) | ||
=002.003\(002.000\) | ||
=2.3.2.0 | ||
=1.0.9-343 | ||
=6.0\(2.1912\) | ||
=11.0\(1\) | ||
=11.1\(1\) | ||
=11.2\(1\) | ||
=11.3\(1\) | ||
=11.4\(1\) | ||
=11.5\(1\) | ||
=11.5\(2\) | ||
=11.5\(3\) | ||
=6.0\(2.1914\) | ||
=1.1 | ||
=8.3\(1\) | ||
=8.4\(1\) | ||
=8.5\(1\) | ||
=9.0\(1\) | ||
=9.0\(2\) | ||
=9.1\(1\) | ||
=12.5\(2\) | ||
=14.0\(1\) | ||
=12.1 | ||
=20.3 | ||
=20.4 | ||
=20.5 | ||
=20.6 | ||
=20.6.1 | ||
=20.7 | ||
=20.8 | ||
=3.1.2 | ||
=3.1.3 | ||
=3.1.4 | ||
=3.1.5 | ||
=3.2.1 | ||
=21.3 | ||
=2.0 | ||
=2.0\(1a\) | ||
=2.0\(1b\) | ||
=2.0\(1c\) | ||
=2.0\(1d\) | ||
=2.0\(1e\) | ||
=2.0\(1f\) | ||
=2.0\(1g\) | ||
=2.0\(1h\) | ||
=2.0\(1k\) | ||
=2.0\(1l\) | ||
=11.5\(1.17900.52\) | ||
=11.5\(1.18119.2\) | ||
=11.5\(1.18900.97\) | ||
=11.5\(1.21900.40\) | ||
=11.5\(1.22900.28\) | ||
=11.5\(1\) | ||
=11.5\(1.22900.6\) | ||
=006.008\(001.000\) | ||
=12.0\(1\) | ||
=12.5\(1\) | ||
=12.6\(1\) | ||
=12.6\(2\) | ||
=12.5\(1\) | ||
=12.5\(1\)-su1 | ||
=12.6\(1\) | ||
=12.6\(2\) | ||
=12.6\(1\) | ||
=11.6\(1\) | ||
=12.0\(1\) | ||
=12.5\(1\) | ||
=12.6\(1\) | ||
=12.6\(1\) | ||
=12.6\(1\)-es01 | ||
=12.6\(1\)-es02 | ||
=12.6\(2\) | ||
=010.000\(000\) | ||
=010.000\(001\) | ||
=010.002\(000\) | ||
=010.002\(001\) | ||
=11.5\(1\)-sr7 | ||
=11.5 | ||
=11.5\(1.10000.6\) | ||
=7.14\(1.26\) | ||
=7.14\(2.26\) | ||
=7.14\(3.025\) | ||
=7.14\(4.018\) | ||
=2.6.6 | ||
=7.1.3 | ||
=7.2.1 | ||
=7.2.2 | ||
=7.2.3 | ||
=7.3 | ||
=7.4 | ||
=7.5 | ||
=7.6 | ||
=3.0 | ||
=4.0 | ||
<8.10.0 | ||
<3.6 | ||
>=6.1<6.4.3.2 | ||
<6.2.4.2 | ||
<=7.3.2 | ||
<13.3 |
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2021-44228 is a remote code execution vulnerability in Apache Log4j2.
CVE-2021-44228 is classified as critical with a severity value of 10.
Apache Log4j2 versions prior to 2.16.0 are affected by CVE-2021-44228.
To fix CVE-2021-44228, upgrade to Apache Log4j2 version 2.16.0 or later.
You can find more information about CVE-2021-44228 at the following references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-44228), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), [GitHub Advisory](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q), [Apache Log4j Security Guide](https://logging.apache.org/log4j/2.x/security.html), [Lunasec Blog](https://www.lunasec.io/docs/blog/log4j-zero-day/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030932), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2021:5137).