CVE-2021-44228: Apache log4j2 log messages substitution (CVE-2021-44228)

Q: What is CVE-2021-44228?

CVE-2021-44228 is a remote code execution vulnerability in Apache Log4j2.

Q: How severe is CVE-2021-44228?

CVE-2021-44228 is classified as critical with a severity value of 10.

Q: Which software is affected by CVE-2021-44228?

Apache Log4j2 versions prior to 2.16.0 are affected by CVE-2021-44228.

Q: How can I fix CVE-2021-44228?

To fix CVE-2021-44228, upgrade to Apache Log4j2 version 2.16.0 or later.

Q: Where can I find more information about CVE-2021-44228?

You can find more information about CVE-2021-44228 at the following references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-44228), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), [GitHub Advisory](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q), [Apache Log4j Security Guide](https://logging.apache.org/log4j/2.x/security.html), [Lunasec Blog](https://www.lunasec.io/docs/blog/log4j-zero-day/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030932), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2021:5137).

Published Dec 10, 2021

Updated

Summary

Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per Apache's Log4j security guide: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.

Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the Updated advice for version 2.16.0 section of this advisory.

Impact

Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

Affected versions

Any Log4J version prior to v2.15.0 is affected to this specific issue.

The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.

Security releases Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3

Affected packages Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.

Remediation Advice

Updated advice for version 2.16.0

The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which disables JNDI by default and completely removes support for message lookups. Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as CVE-2021-45046. More information is available on the GitHub Security Advisory for CVE-2021-45046.

Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded.

Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.

Other sources

A flaw was found in the Java logging library log4j which could allow a remote attacker to execute code on the server if the system logs an attacker controlled string value. This affects versions between 2.0 <= and <= 2.14.1.

— Red Hat

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint.

Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled (CVE-2021-44228).

— FortiGuard

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

— CISA

Credit

CVE-2019-14379, CVE-2021-44228

Affected Software

474 affected componentsFixes available

debian/apache-log4j1.2

1.2.17-8+deb10u21.2.17-8+deb10u11.2.17-10+deb11u11.2.17-11

debian/apache-log4j2

2.17.1-1~deb10u12.17.0-1~deb10u12.17.1-1~deb11u12.17.0-1~deb11u12.19.0-2

debian/apache-log4j2<=2.13.3-1, <=2.7-2, <=2.11.1-2

2.15.0-12.15.0-1~deb11u12.15.0-1~deb10u1

Apache Log4j2

Apple Xcode<13.3

13.3

maven/org.ops4j.pax.logging:pax-logging-log4j2>=2.0.0<2.0.11

2.0.11

maven/org.ops4j.pax.logging:pax-logging-log4j2>=1.11.0<1.11.10

1.11.10

maven/org.ops4j.pax.logging:pax-logging-log4j2>=1.10.0<1.10.8

1.10.8

maven/org.ops4j.pax.logging:pax-logging-log4j2>=1.8.0<1.9.2

1.9.2

maven/org.apache.logging.log4j:log4j-core>=2.0-beta9<2.3.1

2.3.1

maven/uk.co.nichesolutions.logging.log4j:log4j-core=2.6.3-CUSTOM

maven/org.xbib.elasticsearch:log4j=6.3.2.1

maven/com.guicedee.services:log4j-core<=1.2.1.2-jre17

maven/org.apache.logging.log4j:log4j-core>=2.4<2.12.2

2.12.2

maven/org.apache.logging.log4j:log4j-core>=2.13.0<2.15.0

2.15.0

Apache Log4j>=2.0.1<2.3.1

Apache Log4j>=2.4.0<2.12.2

Apache Log4j>=2.13.0<2.15.0

Apache Log4j=2.0

Apache Log4j=2.0-beta9

Apache Log4j=2.0-rc1

Apache Log4j=2.0-rc2

Siemens Sppa-t3000 Ses3000 Firmware

Siemens Sppa-t3000 Ses3000

Siemens Captial<2019.1

Siemens Captial=2019.1

Siemens Captial=2019.1-sp1912

Siemens COMOS

Siemens Desigo Cc Advanced Reports=4.0

Siemens Desigo Cc Advanced Reports=4.1

Siemens Desigo Cc Advanced Reports=4.2

Siemens Desigo Cc Advanced Reports=5.0

Siemens Desigo Cc Advanced Reports=5.1

Siemens Desigo Cc Info Center=5.0

Siemens Desigo Cc Info Center=5.1

Siemens E-car Operation Center<2021-12-13

Siemens Energy Engage=3.1

Siemens Energyip=8.5

Siemens Energyip=8.6

Siemens Energyip=8.7

Siemens Energyip=9.0

Siemens Energyip Prepay=3.7

Siemens Energyip Prepay=3.8

Siemens Gma-manager<8.6.2j-398

Siemens Head-end System Universal Device Integration System

Siemens Industrial Edge Management

Siemens Industrial Edge Management Hub<2021-12-13

Siemens Logo\! Soft Comfort

Siemens Mendix

Siemens Mindsphere<2021-12-11

Siemens Navigator<2021-12-13

Siemens Nx

Siemens Opcenter Intelligence<=3.2

Siemens Operation Scheduler<=1.1.3

Siemens Sentron Powermanager=4.1

Siemens Sentron Powermanager=4.2

Siemens Siguard Dsa=4.2

Siemens Siguard Dsa=4.3

Siemens Siguard Dsa=4.4

Siemens SiPass integrated=2.80

Siemens SiPass integrated=2.85

Siemens Siveillance Command<=4.16.2.1

Siemens Siveillance Control Pro

Siemens Siveillance Identity=1.5

Siemens Siveillance Identity=1.6

Siemens Siveillance Vantage

Siemens Siveillance Viewpoint

Siemens Solid Edge Cam Pro

Siemens Solid Edge Harness Design<2020

Siemens Solid Edge Harness Design=2020

Siemens Solid Edge Harness Design=2020-sp2002

Siemens Spectrum Power 4<4.70

Siemens Spectrum Power 4=4.70

Siemens Spectrum Power 4=4.70-sp7

Siemens Spectrum Power 4=4.70-sp8

Siemens Spectrum Power 7<2.30

Siemens Spectrum Power 7=2.30

Siemens Spectrum Power 7=2.30-sp2

Siemens Teamcenter

Siemens Vesys<2019.1

Siemens Vesys=2019.1

Siemens Vesys=2019.1-sp1912

Siemens Xpedition Enterprise

Siemens Xpedition Package Integrator

Intel Audio Development Kit

Intel Computer Vision Annotation Tool

Intel Data Center Manager<5.1

Intel Genomics Kernel Library

Intel Oneapi Sample Browser Eclipse

Intel Secure Device Onboard

Intel Sensor Solution Firmware Development Kit

Intel System Debugger

Intel System Studio

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Fedoraproject Fedora=34

Fedoraproject Fedora=35

SonicWall Email Security<10.0.12

NetApp Active Iq Unified Manager Linux

NetApp Active Iq Unified Manager Vmware Vsphere

NetApp Active Iq Unified Manager Windows

NetApp Cloud Insights

NetApp Cloud Manager

NetApp Cloud Secure Agent

NetApp OnCommand Insight

NetApp Ontap Tools Vmware Vsphere

NetApp Snapcenter Vmware Vsphere

Cisco Advanced Malware Protection Virtual Private Cloud Appliance<3.5.4

Cisco Automated Subsea Tuning<2.1.0

Cisco BroadWorks<2021.11_1.162

Cisco Business Process Automation<3.0.000.115

Cisco Business Process Automation>=3.1.000.000<3.1.000.044

Cisco Business Process Automation>=3.2.000.000<3.2.000.009

Cisco Cloud Connect<12.6\(1\)

Cisco Cloudcenter<4.10.0.16

Cisco Cloudcenter Cost Optimizer<5.5.2

Cisco Cloudcenter Suite Admin<5.3.1

Cisco Cloudcenter Workload Manager<5.5.2

Cisco Common Services Platform Collector<2.9.1.3

Cisco Common Services Platform Collector>=2.10.0<2.10.0.1

Cisco Connected Mobile Experiences

Cisco Contact Center Domain Manager<12.5\(1\)

Cisco Contact Center Management Portal<12.5\(1\)

Cisco Crosswork Data Gateway<2.0.2

Cisco Crosswork Data Gateway=3.0.0

Cisco Crosswork Network Controller<2.0.1

Cisco Crosswork Network Controller=3.0.0

Cisco Crosswork Optimization Engine<2.0.1

Cisco Crosswork Optimization Engine=3.0.0

Cisco Crosswork Platform Infrastructure<4.0.1

Cisco Crosswork Platform Infrastructure=4.1.0

Cisco Crosswork Zero Touch Provisioning<2.0.1

Cisco Crosswork Zero Touch Provisioning=3.0.0

Cisco Customer Experience Cloud Agent<1.12.1

Cisco Cyber Vision Sensor Management Extension<4.0.3

Cisco Data Center Network Manager<11.3\(1\)

Cisco Data Center Network Manager=11.3\(1\)

Cisco DNA Center<2.1.2.8

Cisco DNA Center>=2.2.2.0<2.2.2.8

Cisco DNA Center>=2.2.3.0<2.2.3.4

Cisco Dna Spaces\<2.5

Cisco Emergency Responder<11.5\(4\)

Cisco Enterprise Chat and Email<12.0\(1\)

Cisco Evolved Programmable Network Manager<=4.1.1

Cisco Finesse<12.6\(1\)

Cisco Finesse=12.6\(1\)

Cisco Fog Director

Cisco Identity Services Engine<2.4.0

Cisco Identity Services Engine=2.4.0

Cisco Integrated Management Controller Supervisor<2.3.2.1

Cisco Intersight Virtual Appliance<1.0.9-361

Cisco Iot Operations Dashboard

Cisco Network Assurance Engine<6.0.2

Cisco Network Services Orchestrator<5.3.5.1

Cisco Network Services Orchestrator>=5.4<5.4.5.2

Cisco Network Services Orchestrator>=5.5<5.5.4.1

Cisco Network Services Orchestrator>=5.6<5.6.3.1

Cisco Nexus Dashboard<2.1.2

Cisco Nexus Insights<6.0.2

Cisco Optical Network Controller<1.1.0

Cisco Packaged Contact Center Enterprise<11.6

Cisco Packaged Contact Center Enterprise=11.6\(1\)

Cisco Paging Server<14.4.1

Cisco Prime Service Catalog<12.1

Cisco SD-WAN vManage<20.3.4.1

Cisco SD-WAN vManage>=20.4<20.4.2.1

Cisco SD-WAN vManage>=20.5<20.5.1.1

Cisco SD-WAN vManage>=20.6<20.6.2.1

Cisco Smart Phy<3.2.1

Cisco Ucs Central<2.0\(1p\)

Cisco UCS Director<6.8.2.0

Cisco Unified Communications Manager<11.5\(1\)

Cisco Unified Communications Manager=11.5\(1\)

Cisco Unified Communications Manager=11.5\(1\)su3

Cisco Unified Communications Manager IM and Presence Service<11.5\(1\)

Cisco Unified Communications Manager IM and Presence Service=11.5\(1\)

Cisco Unified Contact Center Enterprise<11.6\(2\)

Cisco Unified Contact Center Enterprise=11.6\(2\)

Cisco Unified Contact Center Express<12.5\(1\)

Cisco Unified Customer Voice Portal<11.6

Cisco Unified Customer Voice Portal=11.6

Cisco Unified Customer Voice Portal=12.0

Cisco Unified Customer Voice Portal=12.5

Cisco Unity Connection<11.5\(1\)

Cisco Video Surveillance Operations Manager<7.14.4

Cisco Virtual Topology System<2.6.7

Cisco Virtualized Infrastructure Manager<3.2.0

Cisco Virtualized Infrastructure Manager>=3.4.0<3.4.4

Cisco Virtualized Voice Browser<12.5\(1\)

Cisco Wan Automation Engine<7.3.0.2

Cisco Webex Meetings Server<3.0

Cisco Webex Meetings Server=3.0

Cisco Webex Meetings Server=3.0-maintenance_release1

Cisco Webex Meetings Server=3.0-maintenance_release2

Cisco Webex Meetings Server=3.0-maintenance_release3

Cisco Webex Meetings Server=3.0-maintenance_release3_security_patch4

Cisco Webex Meetings Server=3.0-maintenance_release3_security_patch5

Cisco Webex Meetings Server=3.0-maintenance_release3_service_pack_2

Cisco Webex Meetings Server=3.0-maintenance_release3_service_pack_3

Cisco Webex Meetings Server=3.0-maintenance_release4

Cisco Webex Meetings Server=4.0

Cisco Webex Meetings Server=4.0-maintenance_release1

Cisco Webex Meetings Server=4.0-maintenance_release2

Cisco Webex Meetings Server=4.0-maintenance_release3

Cisco Workload Optimization Manager<3.2.1

Cisco Unified Intelligence Center<12.6\(1\)

Cisco Unified Sip Proxy<10.2.1v2

Cisco Unified Workforce Optimization<11.5\(1\)

Cisco FXOS=6.2.3

Cisco FXOS=6.3.0

Cisco FXOS=6.4.0

Cisco FXOS=6.5.0

Cisco FXOS=6.6.0

Cisco FXOS=6.7.0

Cisco FXOS=7.0.0

Cisco FXOS=7.1.0

Cisco Firepower 1010

Cisco Firepower 1120

Cisco Firepower 1140

Cisco Firepower 1150

Cisco Firepower 2110

Cisco Firepower 2120

Cisco Firepower 2130

Cisco Firepower 2140

Cisco Firepower 4110

Cisco Firepower 4112

Cisco Firepower 4115

Cisco Firepower 4120

Cisco Firepower 4125

Cisco Firepower 4140

Cisco Firepower 4145

Cisco Firepower 4150

Cisco Firepower 9300

Cisco Automated Subsea Tuning=02.01.00

Cisco BroadWorks

Cisco Cloudcenter Suite=4.10\(0.15\)

Cisco Cloudcenter Suite=5.3\(0\)

Cisco Cloudcenter Suite=5.4\(1\)

Cisco Cloudcenter Suite=5.5\(0\)

Cisco Cloudcenter Suite=5.5\(1\)

Cisco Common Services Platform Collector=002.009\(000.000\)

Cisco Common Services Platform Collector=002.009\(000.001\)

Cisco Common Services Platform Collector=002.009\(000.002\)

Cisco Common Services Platform Collector=002.009\(001.000\)

Cisco Common Services Platform Collector=002.009\(001.001\)

Cisco Common Services Platform Collector=002.009\(001.002\)

Cisco Common Services Platform Collector=002.010\(000.000\)

Cisco Connected Analytics For Network Deployment=006.004.000.003

Cisco Connected Analytics For Network Deployment=006.005.000.

Cisco Connected Analytics For Network Deployment=006.005.000.000

Cisco Connected Analytics For Network Deployment=007.000.001

Cisco Connected Analytics For Network Deployment=007.001.000

Cisco Connected Analytics For Network Deployment=007.002.000

Cisco Connected Analytics For Network Deployment=7.3

Cisco Connected Analytics For Network Deployment=007.003.000

Cisco Connected Analytics For Network Deployment=007.003.001.001

Cisco Connected Analytics For Network Deployment=007.003.003

Cisco Connected Analytics For Network Deployment=008.000.000

Cisco Connected Analytics For Network Deployment=008.000.000.000.004

Cisco Crosswork Network Automation

Cisco Crosswork Network Automation=2.0.0

Cisco Crosswork Network Automation=3.0.0

Cisco Crosswork Network Automation=4.1.0

Cisco Crosswork Network Automation=4.1.1

Cisco CX Cloud Agent=001.012

Cisco Cyber Vision=4.0.2

Cisco Cyber Vision Sensor Management Extension=4.0.2

Cisco DNA Center=2.2.2.8

Cisco Dna Spaces

Cisco DNA Spaces Connector

Cisco Emergency Responder=11.5

Cisco Emergency Responder=11.5\(4.65000.14\)

Cisco Emergency Responder=11.5\(4.66000.14\)

Cisco Enterprise Chat and Email=12.0\(1\)

Cisco Enterprise Chat and Email=12.5\(1\)

Cisco Enterprise Chat and Email=12.6\(1\)

Cisco Evolved Programmable Network Manager=3.0

Cisco Evolved Programmable Network Manager=3.1

Cisco Evolved Programmable Network Manager=4.0

Cisco Evolved Programmable Network Manager=4.1

Cisco Evolved Programmable Network Manager=5.0

Cisco Evolved Programmable Network Manager=5.1

Cisco Finesse=12.5\(1\)-su1

Cisco Finesse=12.5\(1\)-su2

Cisco Finesse=12.6\(1\)

Cisco Finesse=12.6\(1\)-es01

Cisco Finesse=12.6\(1\)-es02

Cisco Finesse=12.6\(1\)-es03

Cisco Firepower Threat Defense=6.2.3

Cisco Firepower Threat Defense=6.3.0

Cisco Firepower Threat Defense=6.4.0

Cisco Firepower Threat Defense=6.5.0

Cisco Firepower Threat Defense=6.6.0

Cisco Firepower Threat Defense=6.7.0

Cisco Firepower Threat Defense=7.0.0

Cisco Firepower Threat Defense=7.1.0

Cisco Identity Services Engine=002.004\(000.914\)

Cisco Identity Services Engine=002.006\(000.156\)

Cisco Identity Services Engine=002.007\(000.356\)

Cisco Identity Services Engine=003.000\(000.458\)

Cisco Identity Services Engine=003.001\(000.518\)

Cisco Identity Services Engine=003.002\(000.116\)

Cisco Integrated Management Controller Supervisor=002.003\(002.000\)

Cisco Integrated Management Controller Supervisor=2.3.2.0

Cisco Intersight Virtual Appliance=1.0.9-343

Cisco Mobility Services Engine

Cisco Network Assurance Engine=6.0\(2.1912\)

Cisco Network Dashboard Fabric Controller=11.0\(1\)

Cisco Network Dashboard Fabric Controller=11.1\(1\)

Cisco Network Dashboard Fabric Controller=11.2\(1\)

Cisco Network Dashboard Fabric Controller=11.3\(1\)

Cisco Network Dashboard Fabric Controller=11.4\(1\)

Cisco Network Dashboard Fabric Controller=11.5\(1\)

Cisco Network Dashboard Fabric Controller=11.5\(2\)

Cisco Network Dashboard Fabric Controller=11.5\(3\)

Cisco Network Insights For Data Center=6.0\(2.1914\)

Cisco Network Services Orchestrator

Cisco Optical Network Controller=1.1

Cisco Paging Server=8.3\(1\)

Cisco Paging Server=8.4\(1\)

Cisco Paging Server=8.5\(1\)

Cisco Paging Server=9.0\(1\)

Cisco Paging Server=9.0\(2\)

Cisco Paging Server=9.1\(1\)

Cisco Paging Server=12.5\(2\)

Cisco Paging Server=14.0\(1\)

Cisco Prime Service Catalog=12.1

Cisco SD-WAN vManage=20.3

Cisco SD-WAN vManage=20.4

Cisco SD-WAN vManage=20.5

Cisco SD-WAN vManage=20.6

Cisco SD-WAN vManage=20.6.1

Cisco SD-WAN vManage=20.7

Cisco SD-WAN vManage=20.8

Cisco Smart Phy=3.1.2

Cisco Smart Phy=3.1.3

Cisco Smart Phy=3.1.4

Cisco Smart Phy=3.1.5

Cisco Smart Phy=3.2.1

Cisco Smart Phy=21.3

Cisco UCS Central Software=2.0

Cisco UCS Central Software=2.0\(1a\)

Cisco UCS Central Software=2.0\(1b\)

Cisco UCS Central Software=2.0\(1c\)

Cisco UCS Central Software=2.0\(1d\)

Cisco UCS Central Software=2.0\(1e\)

Cisco UCS Central Software=2.0\(1f\)

Cisco UCS Central Software=2.0\(1g\)

Cisco UCS Central Software=2.0\(1h\)

Cisco UCS Central Software=2.0\(1k\)

Cisco UCS Central Software=2.0\(1l\)

Cisco Unified Communications Manager=11.5\(1.17900.52\)

Cisco Unified Communications Manager=11.5\(1.18119.2\)

Cisco Unified Communications Manager=11.5\(1.18900.97\)

Cisco Unified Communications Manager=11.5\(1.21900.40\)

Cisco Unified Communications Manager=11.5\(1.22900.28\)

Cisco Unified Communications Manager Im \& Presence Service=11.5\(1\)

Cisco Unified Communications Manager Im \& Presence Service=11.5\(1.22900.6\)

Cisco Unified Computing System=006.008\(001.000\)

Cisco Unified Contact Center Enterprise=12.0\(1\)

Cisco Unified Contact Center Enterprise=12.5\(1\)

Cisco Unified Contact Center Enterprise=12.6\(1\)

Cisco Unified Contact Center Enterprise=12.6\(2\)

Cisco Unified Contact Center Express=12.5\(1\)

Cisco Unified Contact Center Express=12.5\(1\)-su1

Cisco Unified Contact Center Express=12.6\(1\)

Cisco Unified Contact Center Express=12.6\(2\)

Cisco Unified Contact Center Management Portal=12.6\(1\)

Cisco Unified Customer Voice Portal=11.6\(1\)

Cisco Unified Customer Voice Portal=12.0\(1\)

Cisco Unified Customer Voice Portal=12.5\(1\)

Cisco Unified Customer Voice Portal=12.6\(1\)

Cisco Unified Intelligence Center=12.6\(1\)

Cisco Unified Intelligence Center=12.6\(1\)-es01

Cisco Unified Intelligence Center=12.6\(1\)-es02

Cisco Unified Intelligence Center=12.6\(2\)

Cisco Unified Sip Proxy=010.000\(000\)

Cisco Unified Sip Proxy=010.000\(001\)

Cisco Unified Sip Proxy=010.002\(000\)

Cisco Unified Sip Proxy=010.002\(001\)

Cisco Unified Workforce Optimization=11.5\(1\)-sr7

Cisco Unity Connection=11.5

Cisco Unity Connection=11.5\(1.10000.6\)

Cisco Video Surveillance Manager=7.14\(1.26\)

Cisco Video Surveillance Manager=7.14\(2.26\)

Cisco Video Surveillance Manager=7.14\(3.025\)

Cisco Video Surveillance Manager=7.14\(4.018\)

Cisco Virtual Topology System=2.6.6

Cisco Wan Automation Engine=7.1.3

Cisco Wan Automation Engine=7.2.1

Cisco Wan Automation Engine=7.2.2

Cisco Wan Automation Engine=7.2.3

Cisco Wan Automation Engine=7.3

Cisco Wan Automation Engine=7.4

Cisco Wan Automation Engine=7.5

Cisco Wan Automation Engine=7.6

Cisco Webex Meetings Server=3.0

Cisco Webex Meetings Server=4.0

Snowsoftware Snow Commander<8.10.0

Snowsoftware Vm Access Proxy<3.6

Bentley Synchro>=6.1<6.4.3.2

Bentley Synchro 4d<6.2.4.2

Percussion Rhythmyx<=7.3.2

redhat/log4j<2.15.0

2.15.0

All of the following

Siemens 6bk1602-0aa12-0tp0 Firmware<2.7.0

Siemens 6bk1602-0aa12-0tp0

All of the following

Siemens 6bk1602-0aa22-0tp0 Firmware<2.7.0

Siemens 6bk1602-0aa22-0tp0

All of the following

Siemens 6bk1602-0aa32-0tp0 Firmware<2.7.0

Siemens 6bk1602-0aa32-0tp0

All of the following

Siemens 6bk1602-0aa42-0tp0 Firmware<2.7.0

Siemens 6bk1602-0aa42-0tp0

All of the following

Siemens 6bk1602-0aa52-0tp0 Firmware<2.7.0

Siemens 6bk1602-0aa52-0tp0

All of the following

Siemens Sppa-t3000 Ses3000 Firmware

Siemens Sppa-t3000 Ses3000

Siemens Capital<2019.1

Siemens Capital=2019.1

Siemens Capital=2019.1-sp1912

Siemens COMOS<10.4.2

Siemens Desigo Cc Advanced Reports=3.0

Siemens Energyip Prepay<3.8.0.12

Siemens Mindsphere<2021-12-16

Siemens Opcenter Intelligence>=3.2<3.5

Siemens Siguard Dsa>=4.2<4.4.1

Siemens Vesys=2020.1

Siemens Vesys=2021.1

Intel Datacenter Manager<5.1

SonicWall Email Security<10.0.13

NetApp Brocade San Navigator

NetApp Solidfire \& Hci Storage Node

NetApp Solidfire Enterprise Sds

Cisco Unified Intelligence Center<12.6\(1\)

All of the following

Any of the following

Cisco Firepower 1010

Cisco Firepower 1120

Cisco Firepower 1140

Cisco Firepower 1150

Cisco Firepower 2110

Cisco Firepower 2120

Cisco Firepower 2130

Cisco Firepower 2140

Cisco Firepower 4110

Cisco Firepower 4112

Cisco Firepower 4115

Cisco Firepower 4120

Cisco Firepower 4125

Cisco Firepower 4140

Cisco Firepower 4145

Cisco Firepower 4150

Cisco Firepower 9300

Any of the following

Cisco FXOS=6.2.3

Cisco FXOS=6.3.0

Cisco FXOS=6.4.0

Cisco FXOS=6.5.0

Cisco FXOS=6.6.0

Cisco FXOS=6.7.0

Cisco FXOS=7.0.0

Cisco FXOS=7.1.0

Bentley Synchro>=6.1<6.2.4.2

Bentley Synchro 4d<6.4.3.2

Apple Xcode<13.3

Cisco Cloudcenter Suite=4.10.0.15

Cisco Cloudcenter Suite=5.3.0

Cisco Cloudcenter Suite=5.4.1

Cisco Cloudcenter Suite=5.5.0

Cisco Cloudcenter Suite=5.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/apache-log4j1.2 to a version that resolves this vulnerability.
Fixed in 1.2.17-8+deb10u2Fixed in 1.2.17-8+deb10u1Fixed in 1.2.17-10+deb11u1Fixed in 1.2.17-11
Upgrade
Upgrade debian/apache-log4j2 to a version that resolves this vulnerability.
Fixed in 2.17.1-1~deb10u1Fixed in 2.17.0-1~deb10u1Fixed in 2.17.1-1~deb11u1Fixed in 2.17.0-1~deb11u1Fixed in 2.19.0-2
Upgrade
Upgrade debian/apache-log4j2 to a version that resolves this vulnerability.
Fixed in 2.15.0-1Fixed in 2.15.0-1~deb11u1Fixed in 2.15.0-1~deb10u1
Upgrade
Upgrade Apple Xcode to a version that resolves this vulnerability.
Fixed in 13.3
Upgrade
Upgrade maven/org.ops4j.pax.logging:pax-logging-log4j2 to a version that resolves this vulnerability.
Fixed in 2.0.11
Upgrade
Upgrade maven/org.ops4j.pax.logging:pax-logging-log4j2 to a version that resolves this vulnerability.
Fixed in 1.11.10
Upgrade
Upgrade maven/org.ops4j.pax.logging:pax-logging-log4j2 to a version that resolves this vulnerability.
Fixed in 1.10.8
Upgrade
Upgrade maven/org.ops4j.pax.logging:pax-logging-log4j2 to a version that resolves this vulnerability.
Fixed in 1.9.2
Upgrade
Upgrade maven/org.apache.logging.log4j:log4j-core to a version that resolves this vulnerability.
Fixed in 2.3.1
Upgrade
Upgrade maven/org.apache.logging.log4j:log4j-core to a version that resolves this vulnerability.
Fixed in 2.12.2
Upgrade
Upgrade maven/org.apache.logging.log4j:log4j-core to a version that resolves this vulnerability.
Fixed in 2.15.0
Upgrade
Upgrade redhat/log4j to a version that resolves this vulnerability.
Fixed in 2.15.0
Upgrade
Upgrade org.apache.logging.log4j:log4j-core to a version that resolves this vulnerability.
Fixed in 2.16.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2021-45046
Remove
Remove org.apache.logging.log4j:log4j-core org/apache/logging/log4j/core/lookup/JndiLookup.class from your environment.
Remove the JndiLookup class from the classpath by deleting org/apache/logging/log4j/core/lookup/JndiLookup.class from log4j-core-*.jar (e.g., via zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Configuration
Set the system property log4j2.formatMsgNoLookups (or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS) to true to prevent attacker-controlled message lookups.
Apache Log4j2 log4j2.formatMsgNoLookups = true
Configuration
Modify all PatternLayout patterns to specify the message converter as %m{nolookups} instead of just %m.
Apache Log4j2 PatternLayout message converter pattern = %m{nolookups}

Event History

Dec 10, 2021

CVE Published

via MITRE·12:00 AM

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Advisory Published

via GitHub·12:40 AM

Data Sourced

02:01 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·02:02 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Dec 12, 2021

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Dec 10, 2023

News Published

03:35 PM

Dec 11, 2023

News Published

06:08 PM

News Published

09:25 PM

Dec 26, 2024

News Published

via Dark Reading·02:00 PM

News Published

via Dark Reading·02:01 PM

Dec 12, 2025

News Published

via The Register·06:23 PM

News Published

via The Register·06:27 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2021-44228?

CVE-2021-44228 is a remote code execution vulnerability in Apache Log4j2.

How severe is CVE-2021-44228?

CVE-2021-44228 is classified as critical with a severity value of 10.

Which software is affected by CVE-2021-44228?

Apache Log4j2 versions prior to 2.16.0 are affected by CVE-2021-44228.

How can I fix CVE-2021-44228?

To fix CVE-2021-44228, upgrade to Apache Log4j2 version 2.16.0 or later.

Where can I find more information about CVE-2021-44228?

You can find more information about CVE-2021-44228 at the following references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-44228), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), [GitHub Advisory](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q), [Apache Log4j Security Guide](https://logging.apache.org/log4j/2.x/security.html), [Lunasec Blog](https://www.lunasec.io/docs/blog/log4j-zero-day/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030932), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2021:5137).

CVE-2021-44228: Apache log4j2 log messages substitution (CVE-2021-44228)

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2021-44228?

How severe is CVE-2021-44228?

Which software is affected by CVE-2021-44228?

How can I fix CVE-2021-44228?

Where can I find more information about CVE-2021-44228?

Company

Resources

Contact