{"matches":[{"vulnerability":{"id":"GHSA-jfh8-c2jp-5v3q","dataSource":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","namespace":"github:language:java","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228","https://github.com/apache/logging-log4j2/pull/608","https://github.com/tangxiaofeng7/apache-log4j-poc","https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0","https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup","https://issues.apache.org/jira/browse/LOG4J2-3198","https://issues.apache.org/jira/browse/LOG4J2-3201","https://logging.apache.org/log4j/2.x/manual/migration.html","https://logging.apache.org/log4j/2.x/security.html","http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2021/12/10/1","http://www.openwall.com/lists/oss-security/2021/12/10/2","http://www.openwall.com/lists/oss-security/2021/12/10/3","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://issues.apache.org/jira/browse/LOG4J2-3214","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","http://www.openwall.com/lists/oss-security/2021/12/13/1","http://www.openwall.com/lists/oss-security/2021/12/13/2","https://issues.apache.org/jira/browse/LOG4J2-3221","https://github.com/advisories/GHSA-7rjr-3q55-vv33","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.debian.org/security/2021/dsa-5020","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://www.openwall.com/lists/oss-security/2021/12/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/cisagov/log4j-affected-db","https://support.apple.com/kb/HT213189","https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2","https://security.netapp.com/advisory/ntap-20211210-0007","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","https://github.com/github/advisory-database/pull/5501","https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://seclists.org/fulldisclosure/2022/Dec/2","https://seclists.org/fulldisclosure/2022/Jul/11","https://seclists.org/fulldisclosure/2022/Mar/23","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","http://seclists.org/fulldisclosure/2022/Dec/2","http://seclists.org/fulldisclosure/2022/Jul/11","http://seclists.org/fulldisclosure/2022/Mar/23"],"description":"Remote code injection in Log4j","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","dateAdded":"2021-12-10","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","dueDate":"2021-12-24","knownRansomwareCampaignUse":"known","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],"cwes":["CWE-20","CWE-400","CWE-502"]}],"epss":[{"cve":"CVE-2021-44228","epss":0.99999,"percentile":1,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-44228","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-400","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-502","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-917","source":"nvd@nist.gov","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2021-12-10","kind":"first-observed"}]},"advisories":[],"risk":100},"relatedVulnerabilities":[{"id":"CVE-2021-44228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","namespace":"nvd:cpe","severity":"Critical","urls":["http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2022/Dec/2","http://seclists.org/fulldisclosure/2022/Jul/11","http://seclists.org/fulldisclosure/2022/Mar/23","http://www.openwall.com/lists/oss-security/2021/12/10/1","http://www.openwall.com/lists/oss-security/2021/12/10/2","http://www.openwall.com/lists/oss-security/2021/12/10/3","http://www.openwall.com/lists/oss-security/2021/12/13/1","http://www.openwall.com/lists/oss-security/2021/12/13/2","http://www.openwall.com/lists/oss-security/2021/12/14/4","http://www.openwall.com/lists/oss-security/2021/12/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://github.com/cisagov/log4j-affected-db","https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","https://logging.apache.org/log4j/2.x/security.html","https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.netapp.com/advisory/ntap-20211210-0007/","https://support.apple.com/kb/HT213189","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","https://www.debian.org/security/2021/dsa-5020","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228"],"description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"exploitabilityScore":8.6,"impactScore":10.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","dateAdded":"2021-12-10","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","dueDate":"2021-12-24","knownRansomwareCampaignUse":"known","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],"cwes":["CWE-20","CWE-400","CWE-502"]}],"epss":[{"cve":"CVE-2021-44228","epss":0.99999,"percentile":1,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-44228","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-400","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-502","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44228","cwe":"CWE-917","source":"nvd@nist.gov","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-jfh8-c2jp-5v3q","versionConstraint":">=2.13.0,<2.15.0 (unknown)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-7rjr-3q55-vv33","dataSource":"https://github.com/advisories/GHSA-7rjr-3q55-vv33","namespace":"github:language:java","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-45046","https://logging.apache.org/log4j/2.x/security.html","https://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://www.kb.cert.org/vuls/id/930724","https://www.debian.org/security/2021/dsa-5022","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202310-16","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046","https://www.openwall.com/lists/oss-security/2021/12/18/1","https://www.openwall.com/lists/oss-security/2021/12/15/3","https://logging.apache.org/security.html#CVE-2021-45046","https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1"],"description":"Incomplete fix for Apache Log4j vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","dateAdded":"2023-05-01","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-05-22","knownRansomwareCampaignUse":"known","urls":["https://logging.apache.org/log4j/2.x/security.html","https://nvd.nist.gov/vuln/detail/CVE-2021-45046"],"cwes":["CWE-917"]}],"epss":[{"cve":"CVE-2021-45046","epss":0.99977,"percentile":0.9998,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.16.0"],"state":"fixed","available":[{"version":"2.16.0","date":"2021-12-15","kind":"first-observed"}]},"advisories":[],"risk":99.00000000000001},"relatedVulnerabilities":[{"id":"CVE-2021-45046","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45046","namespace":"nvd:cpe","severity":"Critical","urls":["http://www.openwall.com/lists/oss-security/2021/12/14/4","http://www.openwall.com/lists/oss-security/2021/12/15/3","http://www.openwall.com/lists/oss-security/2021/12/18/1","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/","https://logging.apache.org/log4j/2.x/security.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.gentoo.org/glsa/202310-16","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.debian.org/security/2021/dsa-5022","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046"],"description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"exploitabilityScore":5,"impactScore":6.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","dateAdded":"2023-05-01","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-05-22","knownRansomwareCampaignUse":"known","urls":["https://logging.apache.org/log4j/2.x/security.html","https://nvd.nist.gov/vuln/detail/CVE-2021-45046"],"cwes":["CWE-917"]}],"epss":[{"cve":"CVE-2021-45046","epss":0.99977,"percentile":0.9998,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45046","cwe":"CWE-917","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-7rjr-3q55-vv33","versionConstraint":">=2.13.0,<2.16.0 (unknown)"},"fix":{"suggestedVersion":"2.16.0"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-p6xc-xr62-6r2g","dataSource":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","namespace":"github:language:java","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-45105","https://logging.apache.org/log4j/2.x/security.html","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://www.debian.org/security/2021/dsa-5024","https://www.kb.cert.org/vuls/id/930724","http://www.openwall.com/lists/oss-security/2021/12/19/1","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://security.netapp.com/advisory/ntap-20211218-0001","https://www.zerodayinitiative.com/advisories/ZDI-21-1541","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"],"description":"Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-45105","epss":0.99999,"percentile":0.99991,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.17.0"],"state":"fixed","available":[{"version":"2.17.0","date":"2021-12-19","kind":"first-observed"}]},"advisories":[],"risk":80.499195},"relatedVulnerabilities":[{"id":"CVE-2021-45105","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45105","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2021/12/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","https://logging.apache.org/log4j/2.x/security.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://security.netapp.com/advisory/ntap-20211218-0001/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.debian.org/security/2021/dsa-5024","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1541/"],"description":"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-45105","epss":0.99999,"percentile":0.99991,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-45105","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-45105","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-p6xc-xr62-6r2g","versionConstraint":">=2.13.0,<2.17.0 (unknown)"},"fix":{"suggestedVersion":"2.17.0"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-8489-44mv-ggj8","dataSource":"https://github.com/advisories/GHSA-8489-44mv-ggj8","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44832","https://issues.apache.org/jira/browse/LOG4J2-3293","https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","http://www.openwall.com/lists/oss-security/2021/12/28/1","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://security.netapp.com/advisory/ntap-20220104-0001","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"],"description":"Improper Input Validation and Injection in Apache Log4j2","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44832","epss":0.97906,"percentile":0.99908,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-74","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.17.1"],"state":"fixed","available":[{"version":"2.17.1","date":"2022-01-05","kind":"first-observed"}]},"advisories":[],"risk":56.78548},"relatedVulnerabilities":[{"id":"CVE-2021-44832","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44832","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2021/12/28/1","https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","https://issues.apache.org/jira/browse/LOG4J2-3293","https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/","https://security.netapp.com/advisory/ntap-20220104-0001/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","metrics":{"baseScore":8.5,"exploitabilityScore":6.9,"impactScore":10.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44832","epss":0.97906,"percentile":0.99908,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-74","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2021-44832","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-8489-44mv-ggj8","versionConstraint":">=2.13.0,<2.17.1 (unknown)"},"fix":{"suggestedVersion":"2.17.1"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-3pxv-7cmr-fjr4","dataSource":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34480","https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"description":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34480","epss":0.01187,"percentile":0.67032,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","source":"security@apache.org","type":"Secondary"}],"fix":{"versions":["2.25.4"],"state":"fixed","available":[{"version":"2.25.4","date":"2026-04-11","kind":"first-observed"}]},"advisories":[],"risk":0.706265},"relatedVulnerabilities":[{"id":"CVE-2026-34480","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/apache/logging-log4j2/pull/4077","https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","https://logging.apache.org/security.html#CVE-2026-34480","http://www.openwall.com/lists/oss-security/2026/04/10/9"],"description":"Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34480","epss":0.01187,"percentile":0.67032,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-34480","cwe":"CWE-116","source":"security@apache.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-3pxv-7cmr-fjr4","versionConstraint":">=2.0-alpha1,<2.25.4 (unknown)"},"fix":{"suggestedVersion":"2.25.4"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-vc5p-v9hr-52mj","dataSource":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"description":"Apache Log4j does not verify the TLS hostname in its Socket Appender","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68161","epss":0.00767,"percentile":0.54271,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2025-68161","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.25.3"],"state":"fixed","available":[{"version":"2.25.3","date":"2025-12-20","kind":"first-observed"}]},"advisories":[],"risk":0.43335499999999993},"relatedVulnerabilities":[{"id":"CVE-2025-68161","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/apache/logging-log4j2/pull/4002","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html"],"description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68161","epss":0.00767,"percentile":0.54271,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2025-68161","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2025-68161","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-vc5p-v9hr-52mj","versionConstraint":">=2.0-beta9,<2.25.3 (unknown)"},"fix":{"suggestedVersion":"2.25.3"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}},{"vulnerability":{"id":"GHSA-6hg6-v5c8-fphq","dataSource":"https://github.com/advisories/GHSA-6hg6-v5c8-fphq","namespace":"github:language:java","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-34477","https://github.com/apache/logging-log4j2/pull/4075","https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/security.html#CVE-2026-34477"],"description":"Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34477","epss":0.00502,"percentile":0.4119,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-34477","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2026-34477","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.25.4"],"state":"fixed","available":[{"version":"2.25.4","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.28363},"relatedVulnerabilities":[{"id":"CVE-2026-34477","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34477","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/apache/logging-log4j2/pull/4075","https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/security.html#CVE-2026-34477"],"description":"The fix for  CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161  was incomplete: it addressed hostname verification only when enabled via the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property, but not when configured through the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  attribute of the <Ssl> element.\n\nAlthough the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.\n\nA network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:\n\n  *  An SMTP, Socket, or Syslog appender is in use.\n  *  TLS is configured via a nested <Ssl> element.\n  *  The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.\nThis issue does not affect users of the HTTP appender, which uses a separate  verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName  attribute that was not subject to this bug and verifies host names by default.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security@apache.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34477","epss":0.00502,"percentile":0.4119,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-34477","cwe":"CWE-297","source":"security@apache.org","type":"Secondary"},{"cve":"CVE-2026-34477","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"java-matcher","searchedBy":{"language":"java","namespace":"github:language:java","package":{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-6hg6-v5c8-fphq","versionConstraint":">=2.12.0,<2.25.4 (unknown)"},"fix":{"suggestedVersion":"2.25.4"}}],"artifact":{"id":"09067d186c349ed7","name":"log4j-core","version":"2.14.1","type":"java-archive","locations":[{"path":"/app/log4j-core-2.14.1.jar","layerID":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","accessPath":"/app/log4j-core-2.14.1.jar","annotations":{"evidence":"primary"}}],"language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"cpes":["cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","upstreams":[],"metadataType":"JavaMetadata","metadata":{"virtualPath":"/app/log4j-core-2.14.1.jar","pomArtifactID":"log4j-core","pomGroupID":"org.apache.logging.log4j","manifestName":"","archiveDigests":[{"algorithm":"sha1","value":"9141212b8507ab50a45525b545b39d224614528b"}]}}}],"source":{"type":"image","target":{"userInput":"ghcr.io/haksungjang/scab-log4shell:1.0@sha256:46d9c72ec86b53fe9ad58f2aab7649ffe6aacd78eae31c644982df9600f2f5d1","imageID":"sha256:d5e4e7595a18263686747dc18b613ae095d919b55a0de0e357a9cd03fbb6dcab","manifestDigest":"sha256:086e8b05559755cc716d9c8bd909711bbecea5f6ea0210afc7beaea4219d88de","mediaType":"application/vnd.oci.image.manifest.v1+json","tags":[],"imageSize":1745700,"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851","size":1745700}],"manifest":"ewogICJzY2hlbWFWZXJzaW9uIjogMiwKICAibWVkaWFUeXBlIjogImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubWFuaWZlc3QudjEranNvbiIsCiAgImNvbmZpZyI6IHsKICAgICJtZWRpYVR5cGUiOiAiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsCiAgICAiZGlnZXN0IjogInNoYTI1NjpkNWU0ZTc1OTVhMTgyNjM2ODY3NDdkYzE4YjYxM2FlMDk1ZDkxOWI1NWEwZGUwZTM1N2E5Y2QwM2ZiYjZkY2FiIiwKICAgICJzaXplIjogNDc4CiAgfSwKICAibGF5ZXJzIjogWwogICAgewogICAgICAibWVkaWFUeXBlIjogImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLAogICAgICAiZGlnZXN0IjogInNoYTI1NjoyMjYwMjQ2ODRkMTk0YjA1OTM2ODZkYTk5Y2I5ODI3ZGVkODg5ZmRhZTNjYjQ5NzE1YTljYjExM2YwNTNmZTdiIiwKICAgICAgInNpemUiOiAxNTYyMDk5CiAgICB9CiAgXQp9","config":"eyJhcmNoaXRlY3R1cmUiOiJhcm02NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8ifSwiY3JlYXRlZCI6IjIwMjYtMDctMDFUMjM6MzE6MDMuMzUxNjk5NzcrMDk6MDAiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyNi0wNy0wMVQyMzozMTowMy4zNTE2OTk3NyswOTowMCIsImNyZWF0ZWRfYnkiOiJDT1BZIGxvZzRqLWNvcmUtMi4xNC4xLmphciAvYXBwL2xvZzRqLWNvcmUtMi4xNC4xLmphciAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1Njo0NGM1ZTFjMTIxOTI5OWIxMmNmOGU5MWRkMjJkODA4ZjdmMGI5YTAwZTdkMTAyNmNlYmFjN2I1NTljNzUzODUxIl19fQ==","repoDigests":["ghcr.io/haksungjang/scab-log4shell@sha256:46d9c72ec86b53fe9ad58f2aab7649ffe6aacd78eae31c644982df9600f2f5d1"],"architecture":"arm64","os":"linux"}},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"~/projects/sca-benchmark/.vuln-db-2026-10-14/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":false,"validate-by-hash-on-start":true,"validate-age":false,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-12T00:41:00Z_1791873320.tar.zst?checksum=sha256%3Aed50c6deedbbe39f815f855fb55208a1f261ebec6a91d2847b1230200bbb7b20","built":"2026-10-13T06:35:20Z","path":"~/projects/sca-benchmark/.vuln-db-2026-10-14/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-13T00:39:19Z","input":"xxh64:ec91471f53bafece"},"alpine":{"captured":"2026-10-13T00:39:00Z","input":"xxh64:4e34647efc080919"},"amazon":{"captured":"2026-10-13T00:38:59Z","input":"xxh64:1d440a6fe12cb43e"},"arch":{"captured":"2026-10-13T00:39:07Z","input":"xxh64:be7ff0877c49ab37"},"bitnami":{"captured":"2026-10-13T00:40:02Z","input":"xxh64:de70095674b0bd6a"},"chainguard":{"captured":"2026-10-13T00:39:08Z","input":"xxh64:e2fcc4ecd019f0c3"},"chainguard-libraries":{"captured":"2026-10-13T00:39:12Z","input":"xxh64:2312587aba5f9dbe"},"debian":{"captured":"2026-10-13T00:39:21Z","input":"xxh64:c1c6eed2be2f8542"},"echo":{"captured":"2026-10-13T00:38:53Z","input":"xxh64:678684d41e38a999"},"eol":{"captured":"2026-10-13T00:39:01Z","input":"xxh64:a4f625880b41a599"},"epss":{"captured":"2026-10-13T00:38:57Z","input":"xxh64:a3f29536c4fb718b"},"fedora":{"captured":"2026-10-13T00:39:04Z","input":"xxh64:bca8272bceea3610"},"github":{"captured":"2026-10-13T00:39:22Z","input":"xxh64:d2e9124a32b0a34f"},"govulndb":{"captured":"2026-10-13T00:38:57Z","input":"xxh64:22f1919a589c6961"},"hummingbird":{"captured":"2026-10-13T00:40:10Z","input":"xxh64:aca818e183e3c1b0"},"kev":{"captured":"2026-10-13T00:39:17Z","input":"xxh64:b0d499c7f5ff1cee"},"mariner":{"captured":"2026-10-13T00:38:56Z","input":"xxh64:8e45e13885901728"},"minimos":{"captured":"2026-10-13T00:38:55Z","input":"xxh64:f56940808a75a33c"},"nvd":{"captured":"2026-10-13T00:39:46Z","input":"xxh64:a388f055b49db819"},"oracle":{"captured":"2026-10-13T00:39:05Z","input":"xxh64:9dbe6f51c09db94c"},"photon":{"captured":"2026-10-13T00:39:03Z","input":"xxh64:0022a5e013a8e314"},"rhel":{"captured":"2026-10-13T00:39:18Z","input":"xxh64:6f12e0aff17a6489"},"secureos":{"captured":"2026-10-13T00:38:54Z","input":"xxh64:58dd3cfa3af8ab8f"},"sles":{"captured":"2026-10-12T00:41:00Z","input":"xxh64:4a5a88f30af2896c"},"ubuntu":{"captured":"2026-10-13T00:39:00Z","input":"xxh64:0b36e59d360c17fe"},"wolfi":{"captured":"2026-10-13T00:39:03Z","input":"xxh64:534f4c9c3d08c6f8"}}},"timestamp":"2026-10-15T10:12:58.837391+09:00"}}