critical
9.8
CWE
20 74
Advisory Published
CVE Published
CVE Published
Updated

CVE-2021-44832: Apache log4j2 log messages substitution (CVE-2021-44228)

First published: Sun Dec 12 2021(Updated: )

Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled (CVE-2021-44228).

Credit: security@apache.org security@apache.org

Affected SoftwareAffected VersionHow to fix
redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea
0:2.17.1-1.redhat_00001.1.el8ea
redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea
0:2.17.1-1.redhat_00001.1.el7ea
Apache Log4j=2.0-beta9
Apache Log4j=2.15.0
Apache Log4j=2.17.0
Apache Log4j=1.2.x
redhat/log4j<2.17.1
2.17.1
redhat/log4j<2.12.4
2.12.4
redhat/log4j<2.3.2
2.3.2
Apache Log4j>=2.0.1<2.3.2
Apache Log4j>=2.4<2.12.4
Apache Log4j>=2.13.0<2.17.1
Apache Log4j=2.0
Apache Log4j=2.0-beta7
Apache Log4j=2.0-beta8
Apache Log4j=2.0-beta9
Apache Log4j=2.0-rc1
Apache Log4j=2.0-rc2
Oracle Communications Diameter Signaling Router>=8.0.0.0<=8.5.1.0
Oracle Communications Interactive Session Recorder=6.3
Oracle Communications Interactive Session Recorder=6.4
oracle primavera gateway>=17.12.0<=17.12.11
oracle primavera gateway>=18.8.0<=18.8.13
oracle primavera gateway>=19.12.0<=19.12.12
oracle primavera gateway>=20.12.0<=20.12.7
oracle primavera gateway=21.12.0
Oracle Primavera P6 Enterprise Project Portfolio Management>=19.12.0<=19.12.18.0
Oracle Primavera P6 Enterprise Project Portfolio Management>=20.12.0.0<=20.12.12.0
Oracle Primavera P6 Enterprise Project Portfolio Management=21.12.0.0
Oracle Primavera Unifier=18.8
Oracle Primavera Unifier=19.12
Oracle Primavera Unifier=20.12
Oracle Primavera Unifier=21.12
Oracle Retail Assortment Planning=16.0.3
oracle retail fiscal management=14.2
Oracle Siebel User Interface Framework=21.12
Oracle WebLogic Server=12.2.1.3.0
Oracle WebLogic Server=12.2.1.4.0
Oracle WebLogic Server=14.1.1.0.0
cisco cloudcenter=4.10.0.16
Fedora=34
Fedora=35
Debian=9.0
oracle communications brm - elastic charging engine<12.0.0.4.6
oracle communications brm - elastic charging engine=12.0.0.5.0
Oracle Communications Diameter Signaling Router>=8.3.0.0<=8.5.1.0
oracle communications offline mediation controller<12.0.0.4.4
oracle communications offline mediation controller=12.0.0.5.0
Oracle FLEXCUBE Private Banking=12.1.0
Oracle Health Sciences Data Management Workbench=2.5.2.1
Oracle Health Sciences Data Management Workbench=3.0.0.0
Oracle Health Sciences Data Management Workbench=3.1.0.3
oracle policy automation>=12.2.0<=12.2.24
oracle policy automation for mobile devices>=12.2.0<=12.2.24
Oracle Primavera P6 Enterprise Project Portfolio Management>=19.12.0.0<=19.12.18.0
oracle product lifecycle analytics=3.6.1
Oracle Retail Order Broker=18.0
Oracle Retail Order Broker=19.1
Oracle Retail Xstore Office Cloud Service=17.0.4
Oracle Retail Xstore Office Cloud Service=18.0.3
Oracle Retail Xstore Office Cloud Service=19.0.2
Oracle Retail Xstore Office Cloud Service=20.0.1
Oracle Retail Xstore Office Cloud Service=21.0.1
Oracle Siebel User Interface Framework<=21.12

Remedy

https://issues.apache.org/jira/browse/LOG4J2-3293

Remedy

https://www.oracle.com/security-alerts/cpuapr2022.html

Remedy

https://www.oracle.com/security-alerts/cpujan2022.html

Remedy

https://www.oracle.com/security-alerts/cpujul2022.html

Remedy

As per upstream: - In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java. - Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is CVE-2021-44832?

    CVE-2021-44832 is a vulnerability in Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) that allows a remote code execution (RCE) attack.

  • How severe is CVE-2021-44832?

    CVE-2021-44832 has a severity rating of medium (6.6).

  • Which software versions of Apache Log4j2 are affected by CVE-2021-44832?

    Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are affected by CVE-2021-44832.

  • How can I fix CVE-2021-44832?

    To fix CVE-2021-44832, upgrade to version 2.17.1 of Apache Log4j2.

  • What is the CWE category of CVE-2021-44832?

    CVE-2021-44832 falls under CWE category 20.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203