CVE-2021-44832 Apache Log4j
| Affected software | Apache Log4j |
|---|---|
| Severity | 6.6 Medium CVSS 3.1 3 scores |
| Fixed in | 2.3.2, 2.12.4, 2.17.1 |
| Weakness | Improper input validation (CWE-20) |
| Published | 28 Dec 2021 |
| Updated | 17 Jun 2026 |
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CWE-74
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 7 citations · 1 exploit · earliest 2023-02-14.
- CISA Vulnrichment exploitation: none
- Indexed PoC 2 indexed, none at 5+ stars
- EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-44832 in VulnCheck (free account), which lists 2 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | info.securin.io | /hubfs/Securin%20Ransomware%20Report%202023.pdf | 2023-02-14 |
| Reported exploitation | securin.io | /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf | 2023-08-08 |
| Reported exploitation | ptsecurity.com | /ww-en/analytics/apt-groups-in-the-middle-east | 2024-03-27 |
| Reported exploitation | securityaffairs.com | /163984/hacking/critical-apache-log4j2-flaw-still-threatens-global-finance.html | 2024-06-01 |
| Reported exploitation | pt-global.storage.yandexcloud.net | /positive_research_2024_a9c4fb10c2.pdf | 2024-10-16 |
| Exploit reference | VulnCheck XDB 073626aeed20 | Exploit type: local | 2021-12-29 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | cckuailong/log4j_RCE_CVE-2021-44832 | 4 | 2021-12-29 |
| GitHub PoC | Discover Log4Shell vulnerability [CVE-2021-44832] | 2 | 2021-12-29 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2021-44832.armr patch rule, ARMR 2.6 added 2022-11-10 updated 2026-03-04How to mitigate CVE-2021-44832
Upgrade Apache Log4j to a release that fixes it: 2.3.2, 2.12.4 or 2.17.1. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
6.6 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
6.6 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.6 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 6.6 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 8.5 | none | AV:N/AC:M/Au:S/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Retail Applications / Security (Apache Log4j) (14.1.3.2, 15.0.3.1, 16.0.3) Oracle Retail Applications / Security (Apache Log4j) (15.0.3, 16.0.3) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Food and Beverage Applications / Reporting (Apache Log4j) (9.1.0) Oracle Food and Beverage Applications / Reporting (Apache Log4j) (9.1.0) Oracle Food and Beverage Applications / Reporting (Apache Log4j) (9.1.0) Oracle Siebel CRM / Marketing (Apache Log4j) (22.10 and prior) Oracle Supply Chain / Security (Apache Log4j) (12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Signaling (Apache Log4j) (22.3.0) Oracle Communications / Signaling (Apache Log4j) (22.3.0) Oracle Communications Applications / Framework (Apache Log4j) (6.3.1) Oracle Communications Applications / Installation (Apache Log4j) (10.0.1.6.0) Oracle Communications Applications / Installer (Apache Log4j) (7.3, 7.4) Oracle Essbase / Essbase Web Platform (Apache Log4j) (21.3) Oracle Financial Services Applications / Installer & Configuration (Apache Log4j) (8.0.8.0, 8.1.0.0, 8.1.1.0) Oracle Systems / Tools (Apache Log4j) (4) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Communications Applications / Admin Server and Node Manager (Apache Log4j) (Prior to 12.0.0.4.4, Prior to 12.0.0.5.1) Oracle Communications Applications / Charging Server (Apache Log4j) (Prior to 12.0.0.4.6, Prior to 12.0.0.5.1) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (12.1) Oracle Health Sciences Applications / User Interface (Apache Log4j) (2.5.2.1, 3.0.0.0, 3.1.0.3) Oracle Policy Automation / Core Functionality (Apache Log4j) (12.2.0-12.2.24) Oracle Policy Automation / Determinations Engine (Apache Log4j) (12.2.0-12.2.24) Oracle Retail Applications / Internal Operations (Apache Log4j) (18.0, 19.1) Oracle Retail Applications / Xenvironment (Apache Log4j) (17.0.4, 18.0.3, 19.0.2, 20.0.1, 21.0.1) Oracle Supply Chain / Installation Issues (Apache Log4j) (3.6.1) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Communications / Admin console, LWPR (Apache Log4j) (7.2.1) Oracle Communications / CNC Console (Apache Log4j) (1.9.0) Oracle Communications / Core (Apache Log4j) (4.5) Oracle Communications / DBTier (Apache Log4j) (1.10.0) Oracle Communications / General (Apache Log4j) (Prior to 9.0) Oracle Communications / Management (Apache Log4j) (10.4.0.3) Oracle Communications / NSSF (Apache Log4j) (1.8.0) Oracle Communications / OCNRF (Apache Log4j) (1.15.0, 1.15.1) Oracle Communications / OCSG common services - CORE (Apache Log4j) (7.0.0.0.0) Oracle Communications / Platform (Apache Log4j) (46.6) Oracle Communications / Policy (Apache Log4j) (1.15.0) Oracle Communications / SCP (Apache Log4j) (1.15.0) Oracle Communications / SDC,SCF (Apache Log4j) (7.1) Oracle Communications / SEPP (Apache Log4j) (1.7.0) Oracle Communications / Security (Apache Log4j) (1.5.0) Oracle Communications / Security (Apache Log4j) (12.4) Oracle Communications / Security (Apache Log4j) (Prior to 9.0) Oracle Communications / Third Party (Apache Log4j) (Prior to 9.0) Oracle Communications / UDR (Apache Log4j) (1.15.0) Oracle Communications Applications / Cartridge Deployer Tool (Apache Log4j) (7.3.6) Oracle Communications Applications / Configuration (Apache Log4j) (3.0.2.2, 3.0.3.0) Oracle Communications Applications / Gateway (Apache Log4j) (6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0) Oracle Communications Applications / ISC (Apache Log4j) (8.1) Oracle Communications Applications / Logging (Apache Log4j) (7.3.5, 7.4.1-7.4.2) Oracle Communications Applications / Logging (Apache Log4j) (7.4.0) Oracle Communications Applications / Network Gateway (Apache Log4j) (6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0) Oracle Communications Applications / REST Services Manager (Apache Log4j) (12.0.0.4, 12.0.0.5) Oracle Communications Applications / Rated Event Manager, Business Operations Center, Kafka Data Manager (Apache Log4j) (12.0.0.4, 12.0.0.5) Oracle Communications Applications / SRP (Apache Log4j) (7.3) Oracle Construction and Engineering / Logging (Apache Log4j) (17.1, 17.2, 17.3) Oracle E-Business Suite / Logging (Apache Log4j) (Enterprise Command Center: 7.0) Oracle's note: Oracle E-Business Suite version is 12.2 Oracle E-Business Suite / Logging (Apache Log4j) (Enterprise Information Discovery: 7-9) Oracle's note: Oracle E-Business Suite version is 12.2 Oracle Enterprise Manager / Enterprise Manager Install (Apache Log4j) (13.4.0.0, 13.5.0.0) Oracle Enterprise Manager / Networking (Apache Log4j) (12.4.0.0) Oracle Enterprise Manager / PSEM Plugin (Apache Log4j) (13.4.1.1, 13.5.1.1) Oracle Financial Services Applications / Collections (Apache Log4j) (2.7.1, 2.12.0) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (11.83.3, 12.1-12.4, 14.0-14.3, 14.5) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (14.5) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (14.5) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (14.5) Oracle Financial Services Applications / SECURITY (Apache Log4j) (2.6.2, 2.7.1, 2.12.0) Oracle Financial Services Applications / Web UI (Apache Log4j) (2.12.0) Oracle Financial Services Applications / Web UI (Apache Log4j) (2.12.0) Oracle Financial Services Applications / Web UI (Apache Log4j) (2.7.0) Oracle Fusion Middleware / Advanced UI (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / General and Misc (Apache Log4j) (9.1.0) Oracle Fusion Middleware / Installer (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / MFT Runtime Server (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Oracle JDeveloper (Apache Log4j) (12.2.1.4.0) Oracle Fusion Middleware / Runtime Java agent for ODI (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Security Framework (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle Health Sciences Applications / Cognos logging (Apache Log4j) (6.2.1.1, 6.3.2.1, 7.0.0.0) Oracle Health Sciences Applications / Logging (Apache Log4j) (9.1.0.6, 9.2.0.0) Oracle HealthCare Applications / Datastudio (Apache Log4j) (4.1.1) Oracle HealthCare Applications / FHIR (Apache Log4j) (8.1.1) Oracle HealthCare Applications / IHE (Apache Log4j) (5.0.1) Oracle HealthCare Applications / RPD Generation (Apache Log4j) (7.3.0.1-7.3.0.4) Oracle HealthCare Applications / Record Locator (Apache Log4j) (3.0.1-3.0.4) Oracle Hospitality Applications / Leisure (Apache Log4j) (8.13.0, 8.14.0) Oracle Hospitality Applications / OPI Core (Apache Log4j) (19.1, 20.3) Oracle Hospitality Applications / TPS Service (Apache Log4j) (19.2) Oracle Hyperion / Architect (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Install (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Installation and Configuration (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Installation/Configuration (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Security (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Security (Apache Log4j) (Prior to 11.2.8.0) Oracle Hyperion / Tax Provision (Apache Log4j) (Prior to 11.2.8.0) Oracle Insurance Applications / Framework Administrator IBFA (Apache Log4j) (5.2.0, 5.4.0-5.6.0, 5.6.1) Oracle Insurance Applications / Security (Apache Log4j) (1.0.1) Oracle MySQL / Monitoring: General (Apache Log4j) (8.0.29 and prior) Oracle PeopleSoft / Security (Apache Log4j) (8.58, 8.59) Oracle Retail Applications / Foundation (Apache Log4j) (16.0.3, 19.0.1) Oracle Retail Applications / Installation (Apache Log4j) (17.0.2, 18.0.1, 19.0.1, 20.0.1, 21.0.0) Oracle Retail Applications / Installer (Apache Log4j) (15.0.2, 16.0.2) Oracle Retail Applications / Other (Apache Log4j) (15.0.2, 16.0.2) Oracle Retail Applications / PeopleSoft Integration Bugs (Apache Log4j) (14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1) Oracle Retail Applications / RIB Kernal (Apache Log4j) (14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1) Oracle Retail Applications / RSB Installation (Apache Log4j) (14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1) Oracle Retail Applications / SIM Integration (Apache Log4j) (14.0.4.13, 14.1.3.14, 14.1.3.5, 15.0.3.3, 15.0.3.8, 16.0.3.7) Oracle SQL Developer / Installation (Apache Log4j) (Prior to 21.4.2) Oracle Supply Chain / CAX Client (Apache Log4j) (3.6) Oracle Supply Chain / Installation Issues (Apache Log4j) (6.2.1.0) Oracle Supply Chain / Internal Operations (Apache Log4j) (21.0.2) Oracle Supply Chain / Security (Apache Log4j) (9.3.6) Oracle Taleo / Taleo Connect Client Installer (Apache Log4j) (Prior to 22.1) Oracle Utilities Applications / General (Apache Log4j) (4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / RSS (Apache Log4j) (6.3, 6.4) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Communications / Virtual Network Function Manager, API Gateway (Apache Log4j) (8.3.0.0-8.5.1.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Construction and Engineering / Admin (Apache Log4j) (17.12.0-17.12.11, 18.8.0-18.8.13, 19.12.0-19.12.12, 20.12.0-20.12.7, 21.12.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Construction and Engineering / Logging (Apache Log4j) (18.8, 19.12, 20.12, 21.12) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Construction and Engineering / Web Access (Apache Log4j) (19.12.0.0-19.12.18.0, 20.12.0.0-20.12.12.0, 21.12.0.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Application Core (Apache Log4j) (16.0.3) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / NF Issuing (Apache Log4j) (14.2) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Siebel CRM / Enterprise Cache (Apache Log4j) (21.12 and prior) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Admin console, LWPR (Apache Log4j) | 7.2.1 | 7.2.1 |
| Oracle Communications | CNC Console (Apache Log4j) | 1.9.0 | 1.9.0 |
| Oracle Communications | Core (Apache Log4j) | 4.5 | 4.5 |
| Oracle Communications | DBTier (Apache Log4j) | 1.10.0 | 1.10.0 |
| Oracle Communications | General (Apache Log4j) | Prior to 9.0 | |
| Oracle Communications | Management (Apache Log4j) | 10.4.0.3 | 10.4.0.3 |
| Oracle Communications | NSSF (Apache Log4j) | 1.8.0 | 1.8.0 |
| Oracle Communications | OCNRF (Apache Log4j) | 1.15.0, 1.15.1 | 1.15.0 · 1.15.1 |
| Oracle Communications | OCSG common services - CORE (Apache Log4j) | 7.0.0.0.0 | 7.0.0.0.0 |
| Oracle Communications | Platform (Apache Log4j) | 46.6 | 46.6 |
| Oracle Communications | Policy (Apache Log4j) | 1.15.0 | 1.15.0 |
| Oracle Communications | RSS (Apache Log4j) | 6.3, 6.4 | 6.3 · 6.4 |
| Oracle Communications | SCP (Apache Log4j) | 1.15.0 | 1.15.0 |
| Oracle Communications | SDC,SCF (Apache Log4j) | 7.1 | 7.1 |
| Oracle Communications | SEPP (Apache Log4j) | 1.7.0 | 1.7.0 |
| Oracle Communications | Security (Apache Log4j) | Prior to 9.0 | 1.5.0 · 12.4 |
| Oracle Communications | Signaling (Apache Log4j) | 22.3.0 | 22.3.0 |
| Oracle Communications | Third Party (Apache Log4j) | Prior to 9.0 | |
| Oracle Communications | UDR (Apache Log4j) | 1.15.0 | 1.15.0 |
| Oracle Communications | Virtual Network Function Manager, API Gateway (Apache Log4j) | 8.3.0.0-8.5.1.0 | |
| Oracle Communications Applications | Admin Server and Node Manager (Apache Log4j) | Prior to 12.0.0.4.4, Prior to 12.0.0.5.1 | |
| Oracle Communications Applications | Cartridge Deployer Tool (Apache Log4j) | 7.3.6 | 7.3.6 |
| Oracle Communications Applications | Charging Server (Apache Log4j) | Prior to 12.0.0.4.6, Prior to 12.0.0.5.1 | |
| Oracle Communications Applications | Configuration (Apache Log4j) | 3.0.2.2, 3.0.3.0 | 3.0.2.2 · 3.0.3.0 |
| Oracle Communications Applications | Framework (Apache Log4j) | 6.3.1 | 6.3.1 |
| Oracle Communications Applications | Gateway (Apache Log4j) | 6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0 | 6.0.1.0.0 |
| Oracle Communications Applications | ISC (Apache Log4j) | 8.1 | 8.1 |
| Oracle Communications Applications | Installation (Apache Log4j) | 10.0.1.6.0 | 10.0.1.6.0 |
| Oracle Communications Applications | Installer (Apache Log4j) | 7.3, 7.4 | 7.3 · 7.4 |
| Oracle Communications Applications | Logging (Apache Log4j) | 7.3.5, 7.4.1-7.4.2 | 7.3.5 · 7.4.0 |
| Oracle Communications Applications | Network Gateway (Apache Log4j) | 6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0 | 6.0.1.0.0 |
| Oracle Communications Applications | REST Services Manager (Apache Log4j) | 12.0.0.4, 12.0.0.5 | 12.0.0.4 · 12.0.0.5 |
| Oracle Communications Applications | Rated Event Manager, Business Operations Center, Kafka Data Manager (Apache Log4j) | 12.0.0.4, 12.0.0.5 | 12.0.0.4 · 12.0.0.5 |
| Oracle Communications Applications | SRP (Apache Log4j) | 7.3 | 7.3 |
| Oracle Construction and Engineering | Admin (Apache Log4j) | 17.12.0-17.12.11, 18.8.0-18.8.13, 19.12.0-19.12.12, 20.12.0-20.12.7, 21.12.0 | 21.12.0 |
| Oracle Construction and Engineering | Logging (Apache Log4j) | 17.1, 17.2, 17.3 | 17.1 · 17.2 · 17.3 · 18.8 · 19.12 · 20.12 · 21.12 |
| Oracle Construction and Engineering | Web Access (Apache Log4j) | 19.12.0.0-19.12.18.0, 20.12.0.0-20.12.12.0, 21.12.0.0 | 21.12.0.0 |
| Oracle E-Business Suite | Logging (Apache Log4j) | Enterprise Information Discovery: 7-9 | 7.0 |
| Oracle Enterprise Manager | Enterprise Manager Install (Apache Log4j) | 13.4.0.0, 13.5.0.0 | 13.4.0.0 · 13.5.0.0 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache Log4j) | 13.3.0.1 | 13.3.0.1 |
| Oracle Enterprise Manager | Networking (Apache Log4j) | 12.4.0.0 | 12.4.0.0 |
| Oracle Enterprise Manager | PSEM Plugin (Apache Log4j) | 13.4.1.1, 13.5.1.1 | 13.4.1.1 · 13.5.1.1 |
| Oracle Essbase | Essbase Web Platform (Apache Log4j) | 21.3 | 21.3 |
| Oracle Financial Services Applications | Collections (Apache Log4j) | 2.7.1, 2.12.0 | 2.7.1 · 2.12.0 |
| Oracle Financial Services Applications | Infrastructure (Apache Log4j) | 11.83.3, 12.1-12.4, 14.0-14.3, 14.5 | 11.83.3 · 12.1 · 14.5 |
| Oracle Financial Services Applications | Installer & Configuration (Apache Log4j) | 8.0.8.0, 8.1.0.0, 8.1.1.0 | 8.0.8.0 · 8.1.0.0 · 8.1.1.0 |
| Oracle Financial Services Applications | SECURITY (Apache Log4j) | 2.6.2, 2.7.1, 2.12.0 | 2.6.2 · 2.7.1 · 2.12.0 |
| Oracle Financial Services Applications | Web UI (Apache Log4j) | 2.7.0 | 2.7.0 · 2.12.0 |
| Oracle Food and Beverage Applications | Reporting (Apache Log4j) | 9.1.0 | 9.1.0 |
| Oracle Fusion Middleware | Advanced UI (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | General and Misc (Apache Log4j) | 9.1.0 | 9.1.0 |
| Oracle Fusion Middleware | Installer (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | MFT Runtime Server (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Oracle JDeveloper (Apache Log4j) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Runtime Java agent for ODI (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Health Sciences Applications | Cognos logging (Apache Log4j) | 6.2.1.1, 6.3.2.1, 7.0.0.0 | 6.2.1.1 · 6.3.2.1 · 7.0.0.0 |
| Oracle Health Sciences Applications | Logging (Apache Log4j) | 9.1.0.6, 9.2.0.0 | 9.1.0.6 · 9.2.0.0 |
| Oracle Health Sciences Applications | User Interface (Apache Log4j) | 2.5.2.1, 3.0.0.0, 3.1.0.3 | 2.5.2.1 · 3.0.0.0 · 3.1.0.3 |
| Oracle HealthCare Applications | Datastudio (Apache Log4j) | 4.1.1 | 4.1.1 |
| Oracle HealthCare Applications | FHIR (Apache Log4j) | 8.1.1 | 8.1.1 |
| Oracle HealthCare Applications | IHE (Apache Log4j) | 5.0.1 | 5.0.1 |
| Oracle HealthCare Applications | RPD Generation (Apache Log4j) | 7.3.0.1-7.3.0.4 | |
| Oracle HealthCare Applications | Record Locator (Apache Log4j) | 3.0.1-3.0.4 | |
| Oracle Hospitality Applications | Leisure (Apache Log4j) | 8.13.0, 8.14.0 | 8.13.0 · 8.14.0 |
| Oracle Hospitality Applications | OPI Core (Apache Log4j) | 19.1, 20.3 | 19.1 · 20.3 |
| Oracle Hospitality Applications | TPS Service (Apache Log4j) | 19.2 | 19.2 |
| Oracle Hyperion | Architect (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Hyperion | Install (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Hyperion | Installation and Configuration (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Hyperion | Installation/Configuration (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Hyperion | Security (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Hyperion | Tax Provision (Apache Log4j) | Prior to 11.2.8.0 | |
| Oracle Insurance Applications | Framework Administrator IBFA (Apache Log4j) | 5.2.0, 5.4.0-5.6.0, 5.6.1 | 5.2.0 · 5.6.1 |
| Oracle Insurance Applications | Security (Apache Log4j) | 1.0.1 | 1.0.1 |
| Oracle MySQL | Monitoring: General (Apache Log4j) | 8.0.29 and prior | |
| Oracle PeopleSoft | Security (Apache Log4j) | 8.58, 8.59 | 8.58 · 8.59 |
| Oracle Policy Automation | Core Functionality (Apache Log4j) | 12.2.0-12.2.24 | |
| Oracle Policy Automation | Determinations Engine (Apache Log4j) | 12.2.0-12.2.24 | |
| Oracle Retail Applications | Application Core (Apache Log4j) | 16.0.3 | 16.0.3 |
| Oracle Retail Applications | Foundation (Apache Log4j) | 16.0.3, 19.0.1 | 16.0.3 · 19.0.1 |
| Oracle Retail Applications | Installation (Apache Log4j) | 17.0.2, 18.0.1, 19.0.1, 20.0.1, 21.0.0 | 17.0.2 · 18.0.1 · 19.0.1 · 20.0.1 · 21.0.0 |
| Oracle Retail Applications | Installer (Apache Log4j) | 15.0.2, 16.0.2 | 15.0.2 · 16.0.2 |
| Oracle Retail Applications | Internal Operations (Apache Log4j) | 18.0, 19.1 | 18.0 · 19.1 |
| Oracle Retail Applications | NF Issuing (Apache Log4j) | 14.2 | 14.2 |
| Oracle Retail Applications | Other (Apache Log4j) | 15.0.2, 16.0.2 | 15.0.2 · 16.0.2 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Apache Log4j) | 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 19.0.0 · 19.0.1 |
| Oracle Retail Applications | RIB Kernal (Apache Log4j) | 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 19.0.0 · 19.0.1 |
| Oracle Retail Applications | RSB Installation (Apache Log4j) | 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 19.0.0 · 19.0.1 |
| Oracle Retail Applications | SIM Integration (Apache Log4j) | 14.0.4.13, 14.1.3.14, 14.1.3.5, 15.0.3.3, 15.0.3.8, 16.0.3.7 | 14.0.4.13 · 14.1.3.5 · 14.1.3.14 · 15.0.3.3 · 15.0.3.8 · 16.0.3.7 |
| Oracle Retail Applications | Security (Apache Log4j) | 14.1.3.2, 15.0.3.1, 16.0.3 | 14.1.3.2 · 15.0.3 · 15.0.3.1 · 16.0.3 |
| Oracle Retail Applications | Xenvironment (Apache Log4j) | 17.0.4, 18.0.3, 19.0.2, 20.0.1, 21.0.1 | 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1 · 21.0.1 |
| Oracle SQL Developer | Installation (Apache Log4j) | Prior to 21.4.2 | |
| Oracle Siebel CRM | Enterprise Cache (Apache Log4j) | 21.12 and prior | |
| Oracle Siebel CRM | Marketing (Apache Log4j) | 22.10 and prior | |
| Oracle Supply Chain | CAX Client (Apache Log4j) | 3.6 | 3.6 |
| Oracle Supply Chain | Installation Issues (Apache Log4j) | 3.6.1 | 3.6.1 · 6.2.1.0 |
| Oracle Supply Chain | Internal Operations (Apache Log4j) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | Security (Apache Log4j) | 9.3.6 | 9.3.6 · 12.2.7 · 12.2.8 · 12.2.9 · 12.2.10 · 12.2.11 · 12.2.12 |
| Oracle Systems | Tools (Apache Log4j) | 4 | 4 |
| Oracle Taleo | Taleo Connect Client Installer (Apache Log4j) | Prior to 22.1 | |
| Oracle Utilities Applications | General (Apache Log4j) | 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.logging.log4j:log4j-core |
2.0-beta7 | 2.3.2 |
unbounded |
org.apache.logging.log4j:log4j-core |
2.4 | 2.12.4 |
unbounded |
org.apache.logging.log4j:log4j-core |
2.13.0 | 2.17.1 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.8.0 | 1.9.2 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.10.0 | 1.10.9 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.11.0 | 1.11.13 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
2.0.0 | 2.0.14 |
unbounded |
Products and versions
24 products, 62 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | log4j | generic | 2.0 · 2.0:beta7 · 2.0:beta8 · 2.0:beta9 · 2.0:rc1 · 2.0:rc2 · ≥ 2.0.1 and ＜ 2.3.2 · ≥ 2.4 and ＜ 2.12.4 · ≥ 2.13.0 and ＜ 2.17.1 |
| nvd | cisco | cloudcenter | generic | 4.10.0.16 |
| nvd | debian | debian linux | generic | 9.0 |
| nvd | fedoraproject | fedora | generic | 34 · 35 |
| nvd | oracle | communications brm - elastic charging engine | generic | ＜ 12.0.0.4.6 · 12.0.0.5.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0.0 and ≤ 8.5.1.0 · ≥ 8.3.0.0 and ≤ 8.5.1.0 |
| nvd | oracle | communications interactive session recorder | generic | 6.3 · 6.4 |
| nvd | oracle | communications offline mediation controller | generic | ＜ 12.0.0.4.4 · 12.0.0.5.0 |
| nvd | oracle | flexcube private banking | generic | 12.1.0 |
| nvd | oracle | health sciences data management workbench | generic | 2.5.2.1 · 3.0.0.0 · 3.1.0.3 |
| nvd | oracle | policy automation | generic | ≥ 12.2.0 and ≤ 12.2.24 |
| nvd | oracle | policy automation for mobile devices | generic | ≥ 12.2.0 and ≤ 12.2.24 |
| nvd | oracle | primavera gateway | generic | ≥ 17.12.0 and ≤ 17.12.11 · ≥ 18.8.0 and ≤ 18.8.13 · ≥ 19.12.0 and ≤ 19.12.12 · ≥ 20.12.0 and ≤ 20.12.7 · 21.12.0 |
| nvd | oracle | primavera p6 enterprise project portfolio management | generic | ≥ 19.12.0 and ≤ 19.12.18.0 · ≥ 19.12.0.0 and ≤ 19.12.18.0 · ≥ 20.12.0.0 and ≤ 20.12.12.0 · 21.12.0.0 |
| nvd | oracle | primavera unifier | generic | 18.8 · 19.12 · 20.12 · 21.12 |
| nvd | oracle | product lifecycle analytics | generic | 3.6.1 |
| nvd | oracle | retail assortment planning | generic | 16.0.3 |
| nvd | oracle | retail fiscal management | generic | 14.2 |
| nvd | oracle | retail order broker | generic | 18.0 · 19.1 |
| nvd | oracle | retail xstore point of service | generic | 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1 · 21.0.1 |
| nvd | oracle | siebel ui framework | generic | 21.12 · ≤ 21.12 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| osv | org.apache.logging.log4j | log4j-core | generic | ≥ 2.0 and ＜ 2.3.2 · ≥ 2.4 and ＜ 2.12.4 · ≥ 2.13.0 and ＜ 2.17.1 |
| osv | org.ops4j.pax.logging | pax-logging-log4j2 | generic | ≥ 1.8.0 and ＜ 1.9.2 · ≥ 1.10.0 and ＜ 1.10.9 · ≥ 1.11.0 and ＜ 1.11.13 · ≥ 2.0.0 and ＜ 2.0.14 |
References
Timeline
Timeline
| Published | 2021-12-28 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2022-11-10 | Earliest commit adding this CVE's ARMR patch or security rule. |
| VulnCheck KEV: earliest evidence | 2023-02-14 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-03-23 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |