Read the docs
TI-2021-20283 Aliases CVE-2021-44832GHSA-8489-44mv-ggj8

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Priority HIGH 76CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.97906 99th percentileScored 2026-11-07
Fix Partial Apache Log4j2 (Apache Software Foundation): 2.17.1org.apache.logging.log4j:log4j-core (Maven): 2.3.2, 2.12.4, 2.17.1+1 more productRed Hat: 19 advisoriesRed Hat: 18 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4j2log4j-core to before 2.17.12.17.1Patch availableCNA
—org.apache.logging.log4j:log4j-core (Maven)2.0-beta7 to before 2.3.22.3.2Patch availableGHSA-8489-44mv-ggj8
—org.apache.logging.log4j:log4j-core (Maven)2.4 to before 2.12.42.12.4Patch availableGHSA-8489-44mv-ggj8
—org.apache.logging.log4j:log4j-core (Maven)2.13.0 to before 2.17.12.17.1Patch availableGHSA-8489-44mv-ggj8
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.8.0 to before 1.9.21.9.2Patch availableGHSA-8489-44mv-ggj8
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.10.0 to before 1.10.91.10.9Patch availableGHSA-8489-44mv-ggj8
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)1.11.0 to before 1.11.131.11.13Patch availableGHSA-8489-44mv-ggj8
—org.ops4j.pax.logging:pax-logging-log4j2 (Maven)2.0.0 to before 2.0.142.0.14Patch availableGHSA-8489-44mv-ggj8
  • Apache Log4j2 VendorApache Affected log4j-core to before 2.17.1 Fixed in 2.17.1 Patch available CNA
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.0-beta7 to before 2.3.2 Fixed in 2.3.2 Patch available GHSA-8489-44mv-ggj8
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.4 to before 2.12.4 Fixed in 2.12.4 Patch available GHSA-8489-44mv-ggj8
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.13.0 to before 2.17.1 Fixed in 2.17.1 Patch available GHSA-8489-44mv-ggj8
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.8.0 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-8489-44mv-ggj8
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.10.0 to before 1.10.9 Fixed in 1.10.9 Patch available GHSA-8489-44mv-ggj8
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 1.11.0 to before 1.11.13 Fixed in 1.11.13 Patch available GHSA-8489-44mv-ggj8
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Vendor— Affected 2.0.0 to before 2.0.14 Fixed in 2.0.14 Patch available GHSA-8489-44mv-ggj8

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.0.1 to before 2.3.2; 2.4 to before 2.12.4; 2.13.0 to before 2.17.1VulnerableApache
cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:log4j:2.0:beta7:*:*:*:*:*:*2.0 beta7VulnerableApache
cpe:2.3:a:apache:log4j:2.0:beta8:*:*:*:*:*:*2.0 beta8VulnerableApache
cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*2.0 beta9VulnerableApache
cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*2.0 rc1VulnerableApache
cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*2.0 rc2VulnerableApache
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*6.3VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*6.4VulnerableOracle
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 2.0.1 to before 2.3.2; 2.4 to before 2.12.4; 2.13.0 to before 2.17.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:beta7:*:*:*:*:*:* Versions 2.0 beta7 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:beta8:*:*:*:*:*:* Versions 2.0 beta8 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* Versions 2.0 beta9 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* Versions 2.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* Versions 2.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Oracle
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.12.0 – 17.12.11; 18.8.0 – 18.8.13; 19.12.0 – 19.12.12; 20.12.0 – 20.12.7VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:*21.12.0VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*19.12.0 – 19.12.18.0; 20.12.0.0 – 20.12.12.0VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:*21.12.0.0VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_fiscal_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:cisco:cloudcenter:4.10.0.16:*:*:*:*:*:*:*4.10.0.16VulnerableCisco
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*before 12.0.0.4.6VulnerableOracle
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.3.0.0 – 8.5.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*before 12.0.0.4.4VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*2.5.2.1VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*3.0.0.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.1.0.3:*:*:*:*:*:*:*3.1.0.3VulnerableOracle
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*12.2.0 – 12.2.24VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*12.2.0 – 12.2.24VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*19.12.0.0 – 19.12.18.0VulnerableOracle
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*3.6.1VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.1:*:*:*:*:*:*:*21.0.1VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 21.12VulnerableOracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.13; 19.12.0 – 19.12.12; 20.12.0 – 20.12.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:* Versions 21.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 19.12.0 – 19.12.18.0; 20.12.0.0 – 20.12.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:* Versions 21.12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_fiscal_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:cisco:cloudcenter:4.10.0.16:*:*:*:*:*:*:* Versions 4.10.0.16 Vulnerable ·Cisco
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:* Versions before 12.0.0.4.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.3.0.0 – 8.5.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:* Versions before 12.0.0.4.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* Versions 2.5.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* Versions 3.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.1.0.3:*:*:*:*:*:*:* Versions 3.1.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 19.12.0.0 – 19.12.18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.1:*:*:*:*:*:*:* Versions 21.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 21.12 Vulnerable ·Oracle

Remediation

  • Fix · CNA Apache Log4j2 (Apache Software Foundation) Fixed in 2.17.1
  • Fix · GHSA-8489-44mv-ggj8 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.3.2 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.12.4 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.17.1 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.9.2 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.10.9 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 1.11.13 Advisory →
  • Fix · GHSA-8489-44mv-ggj8 org.ops4j.pax.logging:pax-logging-log4j2 (Maven) Fixed in 2.0.14 Advisory →

Red Hat 19 advisories

  • RHSA-2022:1299 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar, org.jboss.logmanager.log4j-jboss-logmanager-1.2.2.Final-redhat-00002.jar
  • RHSA-2022:1297 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j-2.17.1-1.redhat_00001.1.el8eap
  • RHSA-2022:1296 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j-2.17.1-1.redhat_00001.1.el7eap
Show 16 more Red Hat advisories
  • RHSA-2022:0485 Released 2022-02-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.31 security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive, openshift4/ose-metering-presto
  • RHSA-2022:0493 Released 2022-02-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.43 security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hive, openshift4/ose-metering-presto
  • RHSA-2022:0467 Released 2022-02-08 · Red Hat rating Important
    Red Hat AMQ Streams 1.6.7 release and security update
    • Red Hat AMQ Streams 1.6.7
  • RHSA-2022:0181 Released 2022-01-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.54 extras and security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6
  • RHSA-2022:0236 Released 2022-01-25 · Red Hat rating Moderate
    OpenShift Container Platform 3.11.570 security update
    • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
  • RHSA-2022:0230 Released 2022-01-21 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise Logging bug fix and security update (5.2.6)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8, openshift-logging/kibana6-rhel8
  • RHSA-2022:0227 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.3)
    • OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8, openshift-logging/kibana6-rhel8
  • RHSA-2022:0226 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise Logging bug fix and security update (5.1.7)
    • OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8, openshift-logging/kibana6-rhel8
  • RHSA-2022:0225 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise Logging bug fix and security update (5.0.12)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8
  • RHSA-2022:0223 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.6.3 release and security update
    • Red Hat Integration Camel-K 1.6.3
  • RHSA-2022:0222 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2 security update
    • Red Hat Integration Camel Extensions for Quarkus 2.2
  • RHSA-2022:0216 Released 2022-01-20 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar
  • RHSA-2022:0083 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.8 security update
    • Vert.x 4.1.8
  • RHSA-2022:0205 Released 2022-01-20 · Red Hat rating Moderate
    Red Hat Data Grid 8.2.3 security update
    • Red Hat Data Grid 8.2.3
  • RHSA-2022:0203 Released 2022-01-20 · Red Hat rating Critical
    Red Hat Fuse 7.8-7.10 security update
    • Red Hat Fuse 7.8.2, 7.9.1, 7.10.1
  • RHSA-2022:0138 Released 2022-01-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.0.0 release and security update
    • Red Hat AMQ Streams 2.0.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
OpenShift Logging 5.0Fixed RHSA-2022:0225
OpenShift Logging 5.1Fixed RHSA-2022:0226
OpenShift Logging 5.2Fixed RHSA-2022:0230
OpenShift Logging 5.3Fixed RHSA-2022:0227
Red Hat AMQ Streams 1.6.7Fixed RHSA-2022:0467
Red Hat AMQ Streams 2.0.0Fixed RHSA-2022:0138
Red Hat Data Grid 8.2.3Fixed RHSA-2022:0205
Red Hat Fuse 7.8.2, 7.9.1, 7.10.1Fixed RHSA-2022:0203
Red Hat Integration Camel Extensions for Quarkus 2.2Fixed RHSA-2022:0222
Red Hat Integration Camel-K 1.6.3Fixed RHSA-2022:0223
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:1296
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:1297
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:0216
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2022:0236
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2022:0181
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2022:0493
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2022:0485
Vert.x 4.1.8Fixed RHSA-2022:0083
Not affected: 25 products
  • A-MQ Clients 2
  • OpenShift Logging 5.0
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3
  • Red Hat AMQ Broker 7
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44832
  2. 2026-10-03 Alias added: GHSA-8489-44mv-ggj8

References

Patch 4

Advisory 9

Other 7

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences