VulnerabilityModified

CVE-2021-44832

MEDIUM 6.6EPSS 97.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 97.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

CVSS 3.1: 6.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 97.91% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-74
Affected: apache/log4j · oracle/communications diameter signaling router · oracle/communications interactive session recorder · oracle/primavera gateway · oracle/primavera p6 enterprise project portfolio management · oracle/primavera unifier · oracle/retail assortment planning · oracle/retail fiscal management · oracle/siebel ui framework · oracle/weblogic server · cisco/cloudcenter · fedoraproject/fedora · debian/debian linux · oracle/communications brm - elastic charging engine · oracle/communications offline mediation controller · oracle/flexcube private banking · oracle/health sciences data management workbench · oracle/policy automation · oracle/policy automation for mobile devices · oracle/product lifecycle analytics · +2 more
Source: security@apache.org

References

http://www.openwall.com/lists/oss-security/2021/12/28/1Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdfThird Party Advisory
https://issues.apache.org/jira/browse/LOG4J2-3293Issue Tracking, Patch, Vendor Advisory
https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143Mailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00036.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/
https://security.netapp.com/advisory/ntap-20220104-0001/Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/28/1Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdfThird Party Advisory
https://issues.apache.org/jira/browse/LOG4J2-3293Issue Tracking, Patch, Vendor Advisory
https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143Mailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00036.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/
https://security.netapp.com/advisory/ntap-20220104-0001/Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.