CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache-log4j2	22.04 LTS jammy	Not affected
	21.10 impish	Fixed 2.15.0-0.21.10.1
	21.04 hirsute	Fixed 2.15.0-0.21.04.1
	20.04 LTS focal	Fixed 2.15.0-0.20.04.1
	18.04 LTS bionic	Fixed 2.10.0-2ubuntu0.1
	16.04 LTS xenial	Fixed 2.4-2ubuntu0.1~esm1 Ubuntu Pro
	14.04 LTS trusty	Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

apache-log4j1.2 contains a similar issue in a non-default configuration, and it was assigned CVE-2021-4104, see that CVE for information about apache-log4j1.2

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache-log4j2	Upstream: c77b3cb

Severity score breakdown

Parameter	Value
Base score	10.0 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-5192-1
Apache Log4j 2 vulnerability
14 December 2021

USN-5197-1
Apache Log4j 2 vulnerability
15 December 2021

USN-5192-2
Apache Log4j 2 vulnerability
17 December 2021