Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-5192-1 1 CVE

apache-log4j2 vulnerability

Published Dec 14, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run
programs via a special crafted input. An attacker could use this vulnerability
to cause a denial of service or possibly execute arbitrary code.
Please see the following link for more information:
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS apache-log4j2 2.10.0-2ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS apache-log4j2 2.15.0-0.20.04.1

Vulnerabilities 1

  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021

References

  • report
    https://ubuntu.com/security/CVE-2021-44228