Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j2 | log4j-core – < 2.17.1 | 2.17.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | 2.17.1-1 | — |
| Debian 13 | apache-log4j2 | 2.17.1-1 | — |
| Debian 12 | apache-log4j2 | 2.17.1-1 | — |
| Debian 9 | apache-log4j2 | 2.12.4-0+deb9u1 | DLA-2870-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | apache-log4j2 | No fix yet | — |
| Ubuntu 25.10 | apache-log4j2 | No fix yet | — |
| Ubuntu 20.04 LTS | apache-log4j2 | 2.17.1-0.20.04.1 | USN-5222-1 |
| Ubuntu 18.04 LTS | apache-log4j2 | 2.12.4-0ubuntu0.1 | USN-5222-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-log4j | 2.17.1-1.redhat_00001.1.el7eap | RHSA-2022:1297, RHSA-2022:1296 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | log4j | 2.17.0-4.16.1 | openSUSE-SU-2021:4208-1 |
| openSUSE Leap 15.2 | log4j | 2.17.0-lp152.3.15.1 | openSUSE-SU-2022:0002-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | aws-kinesis-agent | 2.0.6-1.amzn2 | ALAS2-2022-1734 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
cckuailong/log4j_RCE_CVE-2021-44832 ★ 4 · Dec 29, 2021
-
name/log4j-scanner ★ 2 · Dec 29, 2021
Discover Log4Shell vulnerability [CVE-2021-44832]
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j-core | >= 2.0-beta7, < 2.3.2 | 2.3.2 | GHSA-8489-44mv-ggj8 |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.4, < 2.12.4 | 2.12.4 | GHSA-8489-44mv-ggj8 |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.13.0, < 2.17.1 | 2.17.1 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.8.0, < 1.9.2 | 1.9.2 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.10.0, < 1.10.9 | 1.10.9 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.11.0, < 1.11.13 | 1.11.13 | GHSA-8489-44mv-ggj8 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 2.0.0, < 2.0.14 | 2.0.14 | GHSA-8489-44mv-ggj8 |
Advisories 19
- RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-5222-1 apache-log4j2 vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- DLA-2870-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2022:0002-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:4208-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0169 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2022-0197 Apache log4j: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 5, 2025
- WID-SEC-2025-2471 IBM Spectrum Protect Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- VDE-2021-060 WAGO: Smart Script affected by Log4Shell Vulnerability CERT@VDE · May 22, 2025
- WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2023-1524 IBM Spectrum Protect Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 20, 2023
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0123 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0122 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- SESB-2021-347-01 Apache Log4j Vulnerabilities (Log4Shell) Schneider Electric CPCERT · Aug 9, 2022
- ALAS2-2022-1734 Moderate: aws-kinesis-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 20, 2022
- SSA-784507 SSA-784507: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products Siemens ProductCERT · Dec 28, 2021
References
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory
- https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
- https://issues.apache.org/jira/browse/LOG4J2-3293
- [oss-security] 20211228 CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration mailing-list
- [debian-lts-announce] 20211229 [SECURITY] [DLA 2870-1] apache-log4j2 security update mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf
- FEDORA-2021-c6f471ce0f vendor-advisory
- FEDORA-2021-1bd9151bab vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20220104-0001/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html