CVE-2021-44832 — Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Affected: Apache Software Foundation Apache Log4j2

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

USN-5222-1 — apache-log4j2 vulnerabilities

Affected: Ubuntu:18.04:LTS: apache-log4j2, Ubuntu:20.04:LTS: apache-log4j2

It was discovered that Apache Log4j 2 was vulnerable to remote code execution (RCE) attack when configured to use a JDBC Appender with a JNDI LDAP data source URI. A remote attacker could possibly use this issue to cause a crash, leading to a denial of service. (CVE-2021-44832)

Hideki Okamoto and Guy Lederfein discovered that Apache Log4j 2 did not protect against infinite recursion in lookup evaluation. A remote attacker could possibly use this issue to cause Apache Log4j 2 to crash, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-45105)

Most recent entries from all

CVE-2021-44832 — Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

USN-5222-1 — apache-log4j2 vulnerabilities