GHSA-8489-44mv-ggj8

    Dashboard / Vulnerabilities / GHSA-8489-44mv-ggj8

    GHSA-8489-44mv-ggj8

    Published: 4 Jan 2022Last Modified: 9 Jun 2026

    Summary: Improper Input Validation and Injection in Apache Log4j2

    Details: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-44832, https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf, https://github.com/apache/logging-log4j2, https://issues.apache.org/jira/browse/LOG4J2-3293, https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143, https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC, https://lists.fedoraproject.org/archives/list/[email protected]/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA, https://lists.fedoraproject.org/archives/list/[email protected]/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd, https://security.netapp.com/advisory/ntap-20220104-0001, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd, https://www.oracle.com/security-alerts/cpuapr2022.html, https://www.oracle.com/security-alerts/cpujan2022.html, https://www.oracle.com/security-alerts/cpujul2022.html, http://www.openwall.com/lists/oss-security/2021/12/28/1

    Affected packages

    Package

    Name: org.apache.logging.log4j:log4j-core

    Purl: pkg:maven/org.apache.logging.log4j/log4j-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 2.0-beta7
    Fixed -2.3.2

    Affected versions

    2.0
    2.0.1
    2.0.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-8489-44mv-ggj8 | CVE-DB