Apache Log4j2

3 results · Clear filters · Feed

• Medium 6.6
  CVE-2021-44832 Public exploit EPSS 98%

  Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

  Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 28, 2021
• Medium 5.9
  CVE-2021-45105 Public exploit EPSS 100%

  Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

  Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 18, 2021
• Critical 10.0
  CVE-2021-44228 Exploited · Ransomware Public exploit EPSS 100%

  Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 10, 2021

  KEV Dec 10, 2021