UBUNTU-CVE-2021-44832

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-44832

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44832.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-44832

Related

Published

2021-12-28T20:15:00Z

Modified

2024-10-15T14:08:29Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

References

Affected packages

Ubuntu:Pro:16.04:LTS / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2-1

2.4-1

2.4-2

2.4-2ubuntu0.1~esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.12.4-0ubuntu0.1

Affected versions

2.*

2.8.2-1

2.8.2-2

2.10.0-1

2.10.0-2

2.10.0-2ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.12.4-0ubuntu0.1",
            "binary_name": "liblog4j2-java"
        },
        {
            "binary_version": "2.12.4-0ubuntu0.1",
            "binary_name": "liblog4j2-java-doc"
        }
    ]
}

Ubuntu:20.04:LTS / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.17.1-0.20.04.1

Affected versions

2.*

2.11.1-2

2.11.2-1

2.15.0-0.20.04.1

2.16.0-0.20.04.1

2.17.0-0.20.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.17.1-0.20.04.1",
            "binary_name": "liblog4j2-java"
        },
        {
            "binary_version": "2.17.1-0.20.04.1",
            "binary_name": "liblog4j2-java-doc"
        }
    ]
}

Ubuntu:22.04:LTS / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.17.1-1

Affected versions

2.*

2.13.3-1

2.15.0-1

2.16.0-1

2.17.0-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.17.1-1",
            "binary_name": "liblog4j2-java"
        }
    ]
}

Ubuntu:24.10 / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.19.0-2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / apache-log4j2

Package

Name: apache-log4j2
Purl: pkg:deb/ubuntu/apache-log4j2?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.19.0-2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}