kritik
CVE-2021-44228
log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Red Hat, Amazon. Daha düşük diyenler: Ubuntu (yüksek).
Açıklama
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | java-1.6.0-openjdk, java-1.6.0-openjdk-debuginfo, java-1.6.0-openjdk-demo ve 17 tane daha | 1:1.6.0.41-1.13.13.1.78.amzn1 ve 2 tane daha |
| amazon linux 2 | aws-kinesis-agent, java-1.7.0-openjdk, java-1.7.0-openjdk-accessibility ve 31 tane daha | 2.0.4-1.amzn2 ve 4 tane daha |
| amazon linux 2022 | log4j, log4j-jcl, log4j-slf4j | 2.17.2-1.amzn2022.0.3 |
| maven::GitHub Security Advisory Maven | com.guicedee.services:log4j-core, org.apache.logging.log4j:log4j-core, org.ops4j.pax.logging:pax-logging-log4j2 ve 2 tane daha | 2.15.0, 2.3.1, 2.12.2 ve 1 tane daha |
| Red Hat | opendaylight | düzeltme belirtilmemiş |
| debian 10 | apache-log4j2 | 2.15.0-1~deb10u1 |
| debian 11 | apache-log4j2 | 2.15.0-1~deb11u1 |
| debian 12 | apache-log4j2 | 2.15.0-1 |
| debian 13 | apache-log4j2 | 2.15.0-1 |
| debian 14 | apache-log4j2 | 2.15.0-1 |
| debian 9 | apache-log4j2 | 2.7-2+deb9u1 |
| echo | apache-log4j2 | 2.15.0-1 |
19 kaynaktaki 77 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | java-1.6.0-openjdk | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-debuginfo | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-demo | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-devel | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-javadoc | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-src | 1:1.6.0.41-1.13.13.1.78.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-debuginfo | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-demo | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-devel | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-javadoc | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-src | 1:1.7.0.261-2.6.22.1.84.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-debuginfo | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-demo | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-devel | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-headless | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-javadoc | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-javadoc-zip | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-src | 1:1.8.0.312.b07-0.66.amzn1 |
| amazon linux 2 | aws-kinesis-agent | 2.0.4-1.amzn2 |
| amazon linux 2 | java-1.7.0-openjdk | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-accessibility | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-debuginfo | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-demo | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-devel | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-headless | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-javadoc | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.7.0-openjdk-src | 1:1.7.0.261-2.6.22.2.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-accessibility | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-accessibility-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-debuginfo | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-demo | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-demo-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-devel | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-devel-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-headless | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-headless-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-javadoc | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-javadoc-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-javadoc-zip | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-javadoc-zip-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-src | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-1.8.0-openjdk-src-debug | 1:1.8.0.312.b07-1.amzn2.0.2 |
| amazon linux 2 | java-11-amazon-corretto | 1:11.0.13+8-2.amzn2 |
| amazon linux 2 | java-11-amazon-corretto-headless | 1:11.0.13+8-2.amzn2 |
| amazon linux 2 | java-11-amazon-corretto-javadoc | 1:11.0.13+8-2.amzn2 |
| amazon linux 2 | java-17-amazon-corretto | 1:17.0.1+12-3.amzn2.1 |
| amazon linux 2 | java-17-amazon-corretto-devel | 1:17.0.1+12-3.amzn2.1 |
| amazon linux 2 | java-17-amazon-corretto-headless | 1:17.0.1+12-3.amzn2.1 |
| amazon linux 2 | java-17-amazon-corretto-javadoc | 1:17.0.1+12-3.amzn2.1 |
| amazon linux 2 | java-17-amazon-corretto-jmods | 1:17.0.1+12-3.amzn2.1 |
| amazon linux 2022 | log4j | 2.17.2-1.amzn2022.0.3 |
| amazon linux 2022 | log4j-jcl | 2.17.2-1.amzn2022.0.3 |
| amazon linux 2022 | log4j-slf4j | 2.17.2-1.amzn2022.0.3 |
| maven::GitHub Security Advisory Maven | com.guicedee.services:log4j-core | düzeltme belirtilmemiş |
| maven::GitHub Security Advisory Maven | org.apache.logging.log4j:log4j-core | 2.15.0, 2.3.1, 2.12.2 |
| maven::GitHub Security Advisory Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 1.9.2, 1.10.8, 1.11.10, 2.0.11 |
| maven::GitHub Security Advisory Maven | org.xbib.elasticsearch:log4j | düzeltme belirtilmemiş |
| maven::GitHub Security Advisory Maven | uk.co.nichesolutions.logging.log4j:log4j-core | düzeltme belirtilmemiş |
| Red Hat | opendaylight | düzeltme belirtilmemiş |
| debian 10 | apache-log4j2 | 2.15.0-1~deb10u1 |
| debian 11 | apache-log4j2 | 2.15.0-1~deb11u1 |
| debian 12 | apache-log4j2 | 2.15.0-1 |
| debian 13 | apache-log4j2 | 2.15.0-1 |
| debian 14 | apache-log4j2 | 2.15.0-1 |
| debian 9 | apache-log4j2 | 2.7-2+deb9u1 |
| echo | apache-log4j2 | 2.15.0-1 |
| ubuntu 16.04-ESM | apache-log4j2 | 2.4-2ubuntu0.1~esm1 |
| ubuntu 18.04 | apache-log4j2 | 2.10.0-2ubuntu0.1 |
| ubuntu 18.04-ESM | apache-log4j2 | 2.10.0-2ubuntu0.1 |
| ubuntu 20.04 | apache-log4j2 | 2.15.0-0.20.04.1 |
| ubuntu 20.04-ESM | apache-log4j2 | 2.15.0-0.20.04.1 |
| ubuntu 21.04 | apache-log4j2 | 2.15.0-0.21.04.1 |
| ubuntu 21.10 | apache-log4j2 | 2.15.0-0.21.10.1 |
Referanslar
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
87 referansın hepsi
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2022/Dec/2
- http://seclists.org/fulldisclosure/2022/Jul/11
- http://seclists.org/fulldisclosure/2022/Mar/23
- http://www.openwall.com/lists/oss-security/2021/12/10/1
- http://www.openwall.com/lists/oss-security/2021/12/10/2
- http://www.openwall.com/lists/oss-security/2021/12/10/3
- http://www.openwall.com/lists/oss-security/2021/12/13/1
- http://www.openwall.com/lists/oss-security/2021/12/13/2
- http://www.openwall.com/lists/oss-security/2021/12/14/4
- http://www.openwall.com/lists/oss-security/2021/12/15/3
- https://access.redhat.com/security/cve/CVE-2021-44228
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- https://github.com/advisories/GHSA-7rjr-3q55-vv33
- https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
- https://github.com/apache/logging-log4j2
- https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
- https://github.com/apache/logging-log4j2/pull/608
- https://github.com/cisagov/log4j-affected-db
- https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
- https://github.com/github/advisory-database/pull/5501
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
- https://github.com/tangxiaofeng7/apache-log4j-poc
- https://issues.apache.org/jira/browse/LOG4J2-3198
- https://issues.apache.org/jira/browse/LOG4J2-3201
- https://issues.apache.org/jira/browse/LOG4J2-3214
- https://issues.apache.org/jira/browse/LOG4J2-3221
- https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
- https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
- https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
- https://logging.apache.org/log4j/2.x/manual/migration.html
- https://logging.apache.org/log4j/2.x/security.html
- https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2
- https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
- https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
- https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://seclists.org/fulldisclosure/2022/Dec/2
- https://seclists.org/fulldisclosure/2022/Jul/11
- https://seclists.org/fulldisclosure/2022/Mar/23
- https://security.netapp.com/advisory/ntap-20211210-0007
- https://security.netapp.com/advisory/ntap-20211210-0007/
- https://support.apple.com/kb/HT213189
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://twitter.com/kurtseifried/status/1469345530182455296
- https://ubuntu.com/security/notices/USN-5192-1
- https://ubuntu.com/security/notices/USN-5192-2
- https://ubuntu.com/security/notices/USN-5197-1
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
- https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228
- https://www.cve.org/CVERecord?id=CVE-2021-44228
- https://www.debian.org/security/2021/dsa-5020
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- https://www.kb.cert.org/vuls/id/930724
- https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html