USN-5222-1: Apache Log4j 2 vulnerabilities

Q: What configuration is required for the CVE-2021-44832 issue to be exploitable?

Apache Log4j 2 must be configured with a JDBC Appender that uses a JNDI LDAP data source URI. The described impact is a remotely triggered crash causing denial of service.

Q: Which systems are affected by the infinite-recursion lookup issue?

CVE-2021-45105 only affected Ubuntu 18.04 LTS. A remote attacker could trigger a Log4j 2 crash, resulting in denial of service.

Published Jan 11, 2022

Updated

It was discovered that Apache Log4j 2 was vulnerable to remote code execution (RCE) attack when configured to use a JDBC Appender with a JNDI LDAP data source URI. A remote attacker could possibly use this issue to cause a crash, leading to a denial of service. (CVE-2021-44832) Hideki Okamoto and Guy Lederfein discovered that Apache Log4j 2 did not protect against infinite recursion in lookup evaluation. A remote attacker could possibly use this issue to cause Apache Log4j 2 to crash, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-45105)

Affected Software

8 affected componentsFixes available

All of the following

ubuntu/liblog4j2-java<2.17.1-0.21.10.1

2.17.1-0.21.10.1

Ubuntu Ubuntu=21.10

All of the following

ubuntu/liblog4j2-java<2.17.1-0.21.04.1

2.17.1-0.21.04.1

Ubuntu Ubuntu=21.04

All of the following

ubuntu/liblog4j2-java<2.17.1-0.20.04.1

2.17.1-0.20.04.1

Ubuntu Ubuntu=20.04

All of the following

ubuntu/liblog4j2-java<2.12.4-0ubuntu0.1

2.12.4-0ubuntu0.1

Ubuntu Ubuntu=18.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/liblog4j2-java to a version that resolves this vulnerability.
Fixed in 2.17.1-0.21.10.1
Upgrade
Upgrade ubuntu/liblog4j2-java to a version that resolves this vulnerability.
Fixed in 2.17.1-0.21.04.1
Upgrade
Upgrade ubuntu/liblog4j2-java to a version that resolves this vulnerability.
Fixed in 2.17.1-0.20.04.1
Upgrade
Upgrade ubuntu/liblog4j2-java to a version that resolves this vulnerability.
Fixed in 2.12.4-0ubuntu0.1
Upgrade
Upgrade Apache Log4j 2 to a version that resolves this vulnerability.
Patch USN-5222-1

Event History

Jan 11, 2022

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What configuration is required for the CVE-2021-44832 issue to be exploitable?

Apache Log4j 2 must be configured with a JDBC Appender that uses a JNDI LDAP data source URI. The described impact is a remotely triggered crash causing denial of service.

Which systems are affected by the infinite-recursion lookup issue?

CVE-2021-45105 only affected Ubuntu 18.04 LTS. A remote attacker could trigger a Log4j 2 crash, resulting in denial of service.

USN-5222-1: Apache Log4j 2 vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What configuration is required for the CVE-2021-44832 issue to be exploitable?

Which systems are affected by the infinite-recursion lookup issue?

Company

Resources

Contact

Frequently Asked Questions

What configuration is required for the CVE-2021-44832 issue to be exploitable?

Which systems are affected by the infinite-recursion lookup issue?