Skip to content
Fencer Vulns
medium 6.6

CVE-2021-44832 json

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

published 2021-12-28 4 y ago modified 2026-06-17 4 mo ago also GHSA-8489-44mv-ggj8 , EUVD-2022-0516

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
97.9%
EPSS 97.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
0
none known

Summary

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Patch / fix

  • maven org.apache.logging.log4j:log4j-core 2.3.2, 2.12.4, 2.17.1
  • maven org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, 1.10.9, 1.11.13, 2.0.14
  • Apache Software Foundation Apache Log4j2 2.3.2, 2.12.4, 2.17.1
  • apache-log4j2 Debian 14, Debian 13, Debian 12 2.17.1-1

debian advisories DEBIAN-CVE-2021-44832

  • apache-log4j2 Ubuntu 18.04 LTS 2.12.4-0ubuntu0.1
  • apache-log4j2 Ubuntu 20.04 LTS 2.17.1-0.20.04.1

ubuntu advisories UBUNTU-CVE-2021-44832

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-log4j jboss enterprise application platform 7.4 2.17.1-1.redhat_00001.1.el7eap
  • eap7-log4j jboss enterprise application platform 7.4 2.17.1-1.redhat_00001.1.el8eap

red hat advisories RHSA-2022:1296RHSA-2022:1297

  • log4j openSUSE Leap 15.2 2.17.0-lp152.3.15.1
  • log4j openSUSE Leap 15.3 2.17.0-4.16.1

opensuse advisories openSUSE-SU-2022:0002-1openSUSE-SU-2021:4208-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-44832 updated cvss 6.6

log4j-core: remote code execution via JDBC Appender

  • Red Hat Integration Camel Quarkus 1 log4j-core
    affected: workaround, no fix available
  • Red Hat OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8 v5.0.12-1
    fixed: vendor fix RHSA-2022:0225
  • Red Hat OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8 v6.8.1-98
    fixed: vendor fix RHSA-2022:0226
  • Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8 v6.8.1-100
    fixed: vendor fix RHSA-2022:0230
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-99
    fixed: vendor fix RHSA-2022:0227
  • Red Hat AMQ Streams 1.6.7
    fixed: vendor fix RHSA-2022:0467
  • Red Hat AMQ Streams 2.0.0
    fixed: vendor fix RHSA-2022:0138
  • Red Hat Data Grid 8.2.3
    fixed: vendor fix RHSA-2022:0205
show 12 more
  • Red Hat Fuse 7.8.2, 7.9.1, 7.10.1
    fixed: vendor fix RHSA-2022:0203
  • Red Hat Integration Camel Extensions for Quarkus 2.2
    fixed: vendor fix RHSA-2022:0222
  • Red Hat Integration Camel-K 1.6.3
    fixed: vendor fix RHSA-2022:0223
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:1296
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:1297
  • Red Hat JBoss Enterprise Application Platform log4j-api 2.17.1.redhat-00001
    fixed: vendor fix RHSA-2022:0216
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 v3.11.570-2.ge84e80c
    fixed: vendor fix RHSA-2022:0236
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6 v4.6.0-202201181437.p0.g181b827.assembly.stream
    fixed: vendor fix RHSA-2022:0181
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hive v4.7.0-202201271626.p0.g12e974d.assembly.stream, openshift4/ose-metering-presto v4.7.0-202201271626.p0.g2155d34.assembly.stream
    fixed: vendor fix RHSA-2022:0493
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive v4.8.0-202201271626.p0.g8fb24af.assembly.stream, openshift4/ose-metering-presto v4.8.0-202201271626.p0.gf1abc62.assembly.stream
    fixed: vendor fix RHSA-2022:0485
  • Red Hat Vert.x 4.1.8
    fixed: vendor fix RHSA-2022:0083
  • Red Hat A-MQ Clients 2 log4j-core Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.12-1, openshift-logging/kibana6-rhel8 v5.0.12-1, openshift-logging/eventrouter-rhel8 v5.0.12-1, openshift-logging/logging-curator5-rhel8 v5.0.12-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.12-1, openshift-logging/elasticsearch-rhel8-operator v5.0.12-1, +3 more Red Hat OpenShift Logging 5.1 openshift-logging/fluentd-rhel8 v1.7.4-102, openshift-logging/kibana6-rhel8 v6.8.1-108, openshift-logging/eventrouter-rhel8 v0.3.0-97, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-102, openshift-logging/elasticsearch-rhel8-operator v5.1.7-2, openshift-logging/elasticsearch-operator-bundle v5.1.7-3, +2 more Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-104, openshift-logging/kibana6-rhel8 v6.8.1-110, openshift-logging/eventrouter-rhel8 v0.3.0-99, openshift-logging/logging-curator5-rhel8 v5.8.1-73, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-104, openshift-logging/elasticsearch-rhel8-operator v5.2.6-2, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-103, openshift-logging/kibana6-rhel8 v6.8.1-109, openshift-logging/eventrouter-rhel8 v0.3.0-98, openshift-logging/logging-curator5-rhel8 v5.8.1-72, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-103, openshift-logging/elasticsearch-rhel8-operator v5.3.3-3, +4 more Red Hat AMQ Broker 7 log4j-core
    +15 more products
    Red Hat build of Quarkus log4j-core Red Hat Decision Manager 7 log4j-core Red Hat Enterprise Linux 6 log4j, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 7 log4j, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 8 log4j12, log4j12-javadoc Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-xom 1.3.7-1.redhat_00001.1.el7eap, eap7-ecj 3.26.0-1.redhat_00002.1.el7eap, eap7-yasson 1.0.10-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.4-3.GA_redhat_00011.1.el7eap, eap7-objectweb-asm 9.1.0-1.redhat_00002.1.el7eap, eap7-narayana 5.11.4-1.Final_redhat_00001.1.el7eap, +58 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-xom 1.3.7-1.redhat_00001.1.el8eap, eap7-ecj 3.26.0-1.redhat_00002.1.el8eap, eap7-yasson 1.0.10-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.4-3.GA_redhat_00011.1.el8eap, eap7-objectweb-asm 9.1.0-1.redhat_00002.1.el8eap, eap7-narayana 5.11.4-1.Final_redhat_00001.1.el8eap, +56 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1456 more Red Hat JBoss Enterprise Application Platform 6 log4j Red Hat JBoss Enterprise Application Platform Expansion Pack log4j-core Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-eventrouter v3.11.570-2, openshift3/logging-fluentd v3.11.570-2.ge84e80c, openshift3/ose-logging-fluentd v3.11.570-2.ge84e80c, openshift3/ose-logging-kibana5 v3.11.570-2.ge84e80c, openshift3/ose-logging-curator5 v3.11.570-2.ge84e80c Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hadoop Red Hat OpenShift Container Platform 4.6 openshift4/ose-ptp v4.6.0-202201111633.p0.g8f5a67a.assembly.stream, openshift4/ose-sriov-cni v4.6.0-202201111633.p0.gd209fd9.assembly.stream, openshift4/ose-ghostunnel v4.6.0-202201111633.p0.gd5ea7b7.assembly.stream, openshift4/ose-descheduler v4.6.0-202201111633.p0.g4c0ed6d.assembly.stream, openshift4/ose-ptp-operator v4.6.0-202201111855.p0.g97081b3.assembly.stream, openshift4/ose-egress-router v4.6.0-202201111633.p0.g618b71d.assembly.stream, +39 more Red Hat OpenShift Container Platform 4.7 openshift4/ose-ptp v4.7.0-202201261123.p0.g6602684.assembly.stream, openshift4/ose-sriov-cni v4.7.0-202201261123.p0.g2ad0912.assembly.stream, openshift4/ose-ghostunnel v4.7.0-202201261123.p0.g7907399.assembly.stream, openshift4/ose-descheduler v4.7.0-202201261123.p0.g7295089.assembly.stream, openshift4/ose-ptp-operator v4.7.0-202201261123.p0.g0853bcd.assembly.stream, openshift4/ose-egress-router v4.7.0-202201261123.p0.g0e45f63.assembly.stream, +36 more Red Hat OpenShift Container Platform 4.8 openshift4/ose-ptp v4.8.0-202201261123.p0.g2ae5850.assembly.stream, openshift4/ose-sriov-cni v4.8.0-202201261123.p0.gcc1edca.assembly.stream, openshift4/ose-ghostunnel v4.8.0-202201261123.p0.g3f61070.assembly.stream, openshift4/ose-descheduler v4.8.0-202201261123.p0.g37691a4.assembly.stream, openshift4/ose-ptp-operator v4.8.0-202201261123.p0.gd71faa4.assembly.stream, openshift4/ose-egress-router v4.8.0-202201261123.p0.gad38e11.assembly.stream, +34 more
    not affected: vulnerable code not present

4 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

97.91% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C
GitHub 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.logging.log4j:log4j-core
>=2.0-beta7, <2.3.2
>=2.4, <2.12.4
>=2.13.0, <2.17.1
2.3.2
2.12.4
2.17.1
maven org.ops4j.pax.logging:pax-logging-log4j2
>=1.8.0, <1.9.2
>=1.10.0, <1.10.9
>=1.11.0, <1.11.13
>=2.0.0, <2.0.14
1.9.2
1.10.9
1.11.13
2.0.14

Affected products

  • Apache Software Foundation Apache Log4j2

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.