10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.976 High
EPSS
Percentile
100.0%
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2,
2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and
parameters do not protect against attacker controlled LDAP and other JNDI
related endpoints. An attacker who can control log messages or log message
parameters can execute arbitrary code loaded from LDAP servers when message
lookup substitution is enabled. From log4j 2.15.0, this behavior has been
disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and
2.3.1), this functionality has been completely removed. Note that this
vulnerability is specific to log4j-core and does not affect log4net,
log4cxx, or other Apache Logging Services projects.
Author | Note |
---|---|
mdeslaur | apache-log4j1.2 contains a similar issue in a non-default configuration, and it was assigned CVE-2021-4104, see that CVE for information about apache-log4j1.2 |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | apache-log4j2 | < 2.10.0-2ubuntu0.1 | UNKNOWN |
ubuntu | 20.04 | noarch | apache-log4j2 | < 2.15.0-0.20.04.1 | UNKNOWN |
ubuntu | 21.04 | noarch | apache-log4j2 | < 2.15.0-0.21.04.1 | UNKNOWN |
ubuntu | 21.10 | noarch | apache-log4j2 | < 2.15.0-0.21.10.1 | UNKNOWN |
ubuntu | 16.04 | noarch | apache-log4j2 | < 2.4-2ubuntu0.1~esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
github.com/advisories/GHSA-jfh8-c2jp-5v3q
github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
github.com/apache/logging-log4j2/pull/608
github.com/tangxiaofeng7/apache-log4j-poc
launchpad.net/bugs/cve/CVE-2021-44228
nvd.nist.gov/vuln/detail/CVE-2021-44228
security-tracker.debian.org/tracker/CVE-2021-44228
ubuntu.com/security/notices/USN-5192-1
ubuntu.com/security/notices/USN-5192-2
ubuntu.com/security/notices/USN-5197-1
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
www.cve.org/CVERecord?id=CVE-2021-44228
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.976 High
EPSS
Percentile
100.0%