Maven/org.apache.logging.log4j:log4j-core CVE-2021-44832: medium 6.6, EPSS 97.91%
Improper Input Validation and Injection in Apache Log4j2
Action: Upgrade org.apache.logging.log4j:log4j-core to 2.3.2 (2.3.x), 2.12.4 (2.12.x) or 2.17.1 (2.17.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0-beta7 | 2.3.2 | - |
| 2.4 | 2.12.4 | - |
| 2.13.0 | 2.17.1 | - |
Fixed versions
| 2.3.2 | 2.12.4 | 2.17.1 |
Sources
- osv: GHSA-8489-44mv-ggj8
- https://nvd.nist.gov/vuln/detail/CVE-2021-44832
- https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf
- https://github.com/apache/logging-log4j2
- https://issues.apache.org/jira/browse/LOG4J2-3293
- https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
- https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://security.netapp.com/advisory/ntap-20220104-0001
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2021/12/28/1
CVE-2021-44832 · published · modified · JSON