Improper input validation in Apache Log4j
CVE-2021-44832
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.979 (99.9th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 99.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.979 · newest: 0.979 · change: 0.000
Affected products
- Apache Log4j — versions 2.0
- Apache Software Foundation Log4j2 — versions log4j-core
- Cisco Cloudcenter — versions 4.10.0.16
- Oracle Communications Brm - Elastic Charging Engine — versions 12.0.0.5.0
- Oracle Communications Diameter Signaling Router
- Oracle Communications Interactive Session Recorder — versions 6.3, 6.4
- Oracle Communications Offline Mediation Controller — versions 12.0.0.5.0
- Oracle Flexcube Private Banking — versions 12.1.0
- Oracle Health Sciences Data Management Workbench — versions 2.5.2.1, 3.0.0.0, 3.1.0.3
- Oracle Policy Automation
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-l… (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143 (Mailing List, Vendor Advisory)
- issues.apache.org/jira/browse/LOG4J2-3293 (Patch, Issue Tracking, Vendor Advisory)
- www.openwall.com/lists/oss-security/2021/12/28/1 (mailing-list, Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2021/12/msg00036.html (mailing-list, Mailing List, Third Party Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf (Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.oracle.com/security-alerts/cpujan2022.html (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20220104-0001/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-44832?
- CVE-2021-44832 is a medium-severity vulnerability in Apache Log4j, classified under Improper Input Validation. CVSS score: 6.6/10. Published 2021-12-28.
- How severe is CVE-2021-44832?
- Medium severity. CVSS v3 base score is 6.6 out of 10.
- Is CVE-2021-44832 known to be exploited?
- 89 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.