{ "results": [ { "source": { "path": "/app/log4j-core-2.14.1.jar", "type": "artifact" }, "packages": [ { "package": { "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "image_origin_details": { "index": 0 } }, "groups": [ { "ids": [ "GHSA-3pxv-7cmr-fjr4" ], "aliases": [ "CVE-2026-34480", "GHSA-3pxv-7cmr-fjr4" ], "max_severity": "6.9" }, { "ids": [ "GHSA-6hg6-v5c8-fphq" ], "aliases": [ "CVE-2026-34477", "GHSA-6hg6-v5c8-fphq" ], "max_severity": "6.3" }, { "ids": [ "GHSA-7rjr-3q55-vv33" ], "aliases": [ "CVE-2021-45046", "GHSA-7rjr-3q55-vv33" ], "max_severity": "9.0" }, { "ids": [ "GHSA-8489-44mv-ggj8" ], "aliases": [ "CVE-2021-44832", "GHSA-8489-44mv-ggj8" ], "max_severity": "6.6" }, { "ids": [ "GHSA-jfh8-c2jp-5v3q" ], "aliases": [ "CVE-2021-44228", "GHSA-jfh8-c2jp-5v3q" ], "max_severity": "10.0" }, { "ids": [ "GHSA-p6xc-xr62-6r2g" ], "aliases": [ "CVE-2021-45105", "GHSA-p6xc-xr62-6r2g" ], "max_severity": "8.6" }, { "ids": [ "GHSA-vc5p-v9hr-52mj" ], "aliases": [ "CVE-2025-68161", "GHSA-vc5p-v9hr-52mj" ], "max_severity": "6.3" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-alpha1" }, { "fixed": "2.25.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.2", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.25.3", "2.3", "2.3.1", "2.3.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-beta3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0-alpha1", "3.0.0-beta1", "3.0.0-beta2", "3.0.0-beta3" ] } ], "aliases": [ "CVE-2026-34480" ], "database_specific": { "cwe_ids": [ "CWE-116" ], "github_reviewed": true, "github_reviewed_at": "2026-04-10T21:16:41Z", "nvd_published_at": "2026-04-10T16:16:31Z", "severity": "MODERATE" }, "details": "Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n * **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n * **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.", "id": "GHSA-3pxv-7cmr-fjr4", "modified": "2026-09-10T03:50:42.492278990Z", "published": "2026-04-10T18:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4077" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2026-34480" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/04/10/9" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6hg6-v5c8-fphq/GHSA-6hg6-v5c8-fphq.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.12.0" }, { "fixed": "2.25.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.25.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6hg6-v5c8-fphq/GHSA-6hg6-v5c8-fphq.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-beta3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0-alpha1", "3.0.0-beta1", "3.0.0-beta2", "3.0.0-beta3" ] } ], "aliases": [ "CVE-2026-34477" ], "database_specific": { "cwe_ids": [ "CWE-297" ], "github_reviewed": true, "github_reviewed_at": "2026-04-14T00:11:55Z", "nvd_published_at": "2026-04-10T16:16:30Z", "severity": "MODERATE" }, "details": "The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the [`log4j2.sslVerifyHostName`](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property, but not when configured through the [`verifyHostName`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) attribute of the `\u003cSsl\u003e` element.\n\nAlthough the `verifyHostName` configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.\n\nA network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:\n\n * An SMTP, Socket, or Syslog appender is in use.\n * TLS is configured via a nested \u003cSsl\u003e element.\n * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.\n\nThis issue does not affect users of the HTTP appender, which uses a separate [`verifyHostname`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName) attribute that was not subject to this bug and verifies host names by default.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.", "id": "GHSA-6hg6-v5c8-fphq", "modified": "2026-09-10T03:50:43.570169134Z", "published": "2026-04-10T18:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34477" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4075" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2026-34477" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.16.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4.0" }, { "fixed": "2.12.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.12" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] } ], "aliases": [ "CVE-2021-45046" ], "database_specific": { "cwe_ids": [ "CWE-502", "CWE-917" ], "github_reviewed": true, "github_reviewed_at": "2021-12-14T17:55:00Z", "nvd_published_at": "2021-12-14T19:15:00Z", "severity": "CRITICAL" }, "details": "# Impact\n\nThe fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. \n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Mitigation\n\nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (\u003c 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).\n\nLog4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.", "id": "GHSA-7rjr-3q55-vv33", "modified": "2026-10-02T20:30:05.438504645Z", "published": "2021-12-14T18:01:28Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/18/1" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/15/3" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5022" }, { "type": "WEB", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228" }, { "type": "WEB", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202310-16" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2021-45046" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Incomplete fix for Apache Log4j vulnerability" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta7" }, { "fixed": "2.3.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3", "2.3.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4" }, { "fixed": "2.12.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.17.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7", "1.10.8" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.13" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.11", "1.11.12", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.14" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.12", "2.0.13", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-44832" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-74" ], "github_reviewed": true, "github_reviewed_at": "2021-12-28T21:14:19Z", "nvd_published_at": "2021-12-28T20:15:00Z", "severity": "MODERATE" }, "details": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\nThis issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.", "id": "GHSA-8489-44mv-ggj8", "modified": "2026-06-09T10:45:14.253296471Z", "published": "2022-01-04T16:14:20Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3293" }, { "type": "WEB", "url": "https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220104-0001" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/28/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Improper Input Validation and Injection in Apache Log4j2" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.15.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta9" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4" }, { "fixed": "2.12.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "com.guicedee.services:log4j-core", "purl": "pkg:maven/com.guicedee.services/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "1.2.1.2-jre17" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.0.10.0", "1.0.10.0-jre13", "1.0.10.0-jre14", "1.0.10.1", "1.0.10.1-jre14", "1.0.10.3", "1.0.10.3-jre14", "1.0.10.4", "1.0.10.4-jre12", "1.0.10.4-jre13", "1.0.10.4-jre14", "1.0.11.0-jre14", "1.0.11.2-jre14", "1.0.11.5", "1.0.11.5-jre12", "1.0.11.5-jre14", "1.0.11.6-jre14", "1.0.11.7", "1.0.11.7-jre12", "1.0.11.7-jre14", "1.0.12.0", "1.0.12.0-jre12", "1.0.12.0-jre13", "1.0.12.0-jre14", "1.0.12.0-jre8", "1.0.12.1", "1.0.12.1-jre12", "1.0.12.1-jre14", "1.0.12.2", "1.0.12.2-jre12", "1.0.12.2-jre14", "1.0.12.3", "1.0.12.3-jre12", "1.0.12.3-jre13", "1.0.12.3-jre14", "1.0.12.4", "1.0.12.4-jre12", "1.0.12.4-jre13", "1.0.12.4-jre14", "1.0.12.4-jre8", "1.0.12.5", "1.0.12.5-jre14", "1.0.13.0", "1.0.13.0-jre12", "1.0.13.0-jre13", "1.0.13.0-jre14", "1.0.13.0-jre8", "1.0.13.1", "1.0.13.1-jre13", "1.0.13.1-jre14", "1.0.13.1-jre8", "1.0.13.2", "1.0.13.2-jre12", "1.0.13.2-jre13", "1.0.13.2-jre14", "1.0.13.2-jre8", "1.0.13.3", "1.0.13.3-jre14", "1.0.13.4", "1.0.13.4-jre12", "1.0.13.4-jre13", "1.0.13.4-jre14", "1.0.13.5", "1.0.13.5-jre12", "1.0.13.5-jre14", "1.0.13.5-jre8", "1.0.14.0-RC1-jre14", "1.0.14.0-RC1-jre8", "1.0.14.1", "1.0.14.1-jre12", "1.0.14.1-jre13", "1.0.14.1-jre14", "1.0.14.1-jre8", "1.0.14.3-jre8", "1.0.14.4-jre14", "1.0.14.4-jre8", "1.0.15.1", "1.0.15.1-jre12", "1.0.15.1-jre13", "1.0.15.1-jre14", "1.0.15.1-jre8", "1.0.15.2", "1.0.15.2-jre12", "1.0.15.2-jre14", "1.0.15.2-jre8", "1.0.15.3-jre14", "1.0.15.3-jre8", "1.0.15.4", "1.0.15.4-jre14", "1.0.15.4-jre8", "1.0.15.5", "1.0.15.5-jre14", "1.0.15.5-jre8", "1.0.16.0", "1.0.16.0-jre14", "1.0.16.0-jre8", "1.0.17.0", "1.0.17.0-jre14", "1.0.17.1", "1.0.17.1-jre14", "1.0.17.1-jre8", "1.0.18.0", "1.0.18.0-jre14", "1.0.18.0-jre15", "1.0.18.0-jre8", "1.0.18.1", "1.0.18.1-jre14", "1.0.18.1-jre15", "1.0.18.1-jre8", "1.0.19.0", "1.0.19.0-jre14", "1.0.19.0-jre15", "1.0.19.1", "1.0.19.1-jre12", "1.0.19.1-jre13", "1.0.19.1-jre14", "1.0.19.1-jre15", "1.0.19.1-jre8", "1.0.19.10", "1.0.19.10-jre12", "1.0.19.10-jre14", "1.0.19.10-jre15", "1.0.19.10-jre8", "1.0.19.11", "1.0.19.11-jre14", "1.0.19.11-jre8", "1.0.19.12-jre14", "1.0.19.12-jre8", "1.0.19.13", "1.0.19.13-jre14", "1.0.19.13-jre15", "1.0.19.13-jre8", "1.0.19.2", "1.0.19.2-jre13", "1.0.19.2-jre14", "1.0.19.2-jre15", "1.0.19.2-jre8", "1.0.19.3", "1.0.19.3-jre13", "1.0.19.3-jre14", "1.0.19.3-jre15", "1.0.19.3-jre8", "1.0.19.4", "1.0.19.4-jre14", "1.0.19.4-jre15", "1.0.19.4-jre8", "1.0.19.5", "1.0.19.5-jre14", "1.0.19.5-jre15", "1.0.19.5-jre8", "1.0.19.6", "1.0.19.6-jre14", "1.0.19.6-jre8", "1.0.19.7-jre14", "1.0.19.7-jre8", "1.0.19.8-jre8", "1.0.19.9", "1.0.19.9-jre13", "1.0.19.9-jre14", "1.0.19.9-jre15", "1.0.19.9-jre8", "1.0.2.15", "1.0.2.15-jre13", "1.0.2.16-jre13", "1.0.2.17-jre13", "1.0.2.18", "1.0.2.18-jre12", "1.0.2.18-jre13", "1.0.20.0", "1.0.20.0-jre14", "1.0.20.0-jre15", "1.0.20.0-jre8", "1.0.20.1", "1.0.20.1-jre14", "1.0.20.1-jre15", "1.0.20.1-jre8", "1.0.20.2", "1.0.20.2-jre14", "1.0.20.2-jre15", "1.0.20.2-jre8", "1.0.3.1-jre13", "1.0.3.2", "1.0.3.2-jre13", "1.0.3.3", "1.0.3.3-jre12", "1.0.3.3-jre13", "1.0.4.1-jre13", "1.0.4.2", "1.0.4.2-jre13", "1.0.4.3-jre13", "1.0.4.4", "1.0.4.4-jre13", "1.0.5.0", "1.0.5.0-jre13", "1.0.5.1", "1.0.5.1-jre12", "1.0.5.1-jre13", "1.0.5.2", "1.0.5.2-jre12", "1.0.5.2-jre13", "1.0.5.3", "1.0.5.3-jre12", "1.0.5.3-jre13", "1.0.5.4-jre13", "1.0.5.4-jre14", "1.0.5.5", "1.0.5.5-jre12", "1.0.5.5-jre13", "1.0.5.5-jre14", "1.0.6.1", "1.0.6.1-jre12", "1.0.6.1-jre13", "1.0.6.1-jre14", "1.0.6.2", "1.0.6.2-jre12", "1.0.6.2-jre13", "1.0.6.2-jre14", "1.0.6.3", "1.0.6.3-jre12", "1.0.6.3-jre13", "1.0.6.3-jre14", "1.0.6.4-jre14", "1.0.6.5", "1.0.6.5-jre12", "1.0.6.5-jre13", "1.0.6.5-jre14", "1.0.6.7", "1.0.6.7-jre14", "1.0.7.0", "1.0.7.0-jre12", "1.0.7.0-jre13", "1.0.7.0-jre14", "1.0.7.1", "1.0.7.1-jre13", "1.0.7.1-jre14", "1.0.7.10", "1.0.7.10-jre13", "1.0.7.10-jre14", "1.0.7.11", "1.0.7.11-jre14", "1.0.7.12", "1.0.7.12-jre12", "1.0.7.12-jre13", "1.0.7.12-jre14", "1.0.7.2-jre14", "1.0.7.3", "1.0.7.3-jre13", "1.0.7.3-jre14", "1.0.7.4", "1.0.7.4-jre14", "1.0.7.5", "1.0.7.5-jre14", "1.0.7.6", "1.0.7.6-jre14", "1.0.7.9", "1.0.7.9-jre14", "1.0.8.1", "1.0.8.1-jre14", "1.0.8.12", "1.0.8.12-jre12", "1.0.8.12-jre14", "1.0.8.16", "1.0.8.16-jre14", "1.0.8.18", "1.0.8.18-jre14", "1.0.8.2", "1.0.8.2-jre13", "1.0.8.2-jre14", "1.0.8.3", "1.0.8.3-jre13", "1.0.8.3-jre14", "1.0.8.4", "1.0.8.4-jre12", "1.0.8.4-jre13", "1.0.8.4-jre14", "1.0.8.5", "1.0.8.5-jre12", "1.0.8.5-jre13", "1.0.8.5-jre14", "1.0.8.6-jre14", "1.0.9.0", "1.0.9.0-jre14", "1.0.9.1", "1.0.9.1-jre14", "1.0.9.10", "1.0.9.10-jre14", "1.0.9.11", "1.0.9.11-jre14", "1.0.9.13", "1.0.9.13-jre14", "1.0.9.14", "1.0.9.14-jre14", "1.0.9.2", "1.0.9.2-jre14", "1.0.9.3-jre14", "1.0.9.4-jre14", "1.0.9.5-jre14", "1.0.9.7-jre14", "1.1.0.0-jre15", "1.1.0.1", "1.1.0.1-jre14", "1.1.0.1-jre15", "1.1.0.2", "1.1.0.2-jre14", "1.1.0.2-jre15", "1.1.0.3", "1.1.0.3-jre14", "1.1.0.3-jre15", "1.1.0.3-jre8", "1.1.0.4-jre14", "1.1.0.4-jre15", "1.1.0.4-jre8", "1.1.0.5-jre14", "1.1.0.5-jre15", "1.1.0.6", "1.1.0.6-jre14", "1.1.0.6-jre15", "1.1.0.7", "1.1.0.7-jre14", "1.1.0.7-jre15", "1.1.0.7-jre8", "1.1.0.8-SNAPSHOT-jre14", "1.1.1.0", "1.1.1.0-SNAPSHOT-jre14", "1.1.1.0-SNAPSHOT-jre15", "1.1.1.0-SNAPSHOT-jre8", "1.1.1.0-jre14", "1.1.1.0-jre15", "1.1.1.0-jre8", "1.1.1.1-SP1", "1.1.1.1-jre14-SP1", "1.1.1.1-jre15-SP1", "1.1.1.2", "1.1.1.2-jre14", "1.1.1.2-jre15", "1.1.1.3", "1.1.1.3-jre14", "1.1.1.3-jre15", "1.1.1.3-jre16", "1.1.1.3-jre8", "1.1.1.4", "1.1.1.4-jre14", "1.1.1.4-jre15", "1.1.1.4-jre16", "1.1.1.4-jre8", "1.1.1.5-jre15", "1.1.1.7", "1.1.1.7-jre15", "1.1.1.7-jre16", "1.1.1.7-jre8", "1.1.1.8-jre15", "1.1.1.8-jre16", "1.1.1.9-jre15", "1.1.1.9-jre16", "1.2.0.0-jre16", "1.2.0.1-jre11", "1.2.0.1-jre15", "1.2.0.1-jre16", "1.2.0.2-jre16", "1.2.0.3-jre17-rc1", "1.2.1.1-jre17", "1.2.1.2-jre17" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.xbib.elasticsearch:log4j", "purl": "pkg:maven/org.xbib.elasticsearch/log4j" }, "versions": [ "6.3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "uk.co.nichesolutions.logging.log4j:log4j-core", "purl": "pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core" }, "versions": [ "2.6.3-CUSTOM" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-44228" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-400", "CWE-502", "CWE-917" ], "github_reviewed": true, "github_reviewed_at": "2021-12-10T00:40:41Z", "nvd_published_at": "2021-12-10T10:15:00Z", "severity": "CRITICAL" }, "details": "# Summary\n\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\nAs per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 \u003c=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.\n\nLog4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory.\n\n# Impact\n\nLogging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. \n\n# Affected versions\n\nAny Log4J version prior to v2.15.0 is affected to this specific issue.\n\nThe v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.\n\n## Security releases\nAdditional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3\n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Remediation Advice\n\n## Updated advice for version 2.16.0\n\nThe Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0).\nEven in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33).\n\nUsers who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221).\n\nPlease note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.", "id": "GHSA-jfh8-c2jp-5v3q", "modified": "2025-10-22T19:37:02.616807Z", "published": "2021-12-10T00:40:56Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/608" }, { "type": "WEB", "url": "https://github.com/github/advisory-database/pull/5501" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Dec/2" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Jul/11" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Mar/23" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20211210-0007" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT213189" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://twitter.com/kurtseifried/status/1469345530182455296" }, { "type": "WEB", "url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001" }, { "type": "WEB", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5020" }, { "type": "WEB", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-7rjr-3q55-vv33" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://github.com/cisagov/log4j-affected-db" }, { "type": "WEB", "url": "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md" }, { "type": "WEB", "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228" }, { "type": "WEB", "url": "https://github.com/tangxiaofeng7/apache-log4j-poc" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3198" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3201" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3214" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3221" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/migration.html" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Dec/2" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Jul/11" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Mar/23" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/3" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/13/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/13/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/14/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/15/3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H", "type": "CVSS_V3" } ], "summary": "Remote code injection in Log4j" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4.0" }, { "fixed": "2.12.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.17.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7", "1.10.8" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.12" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.11", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.13" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.12", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-45105" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-674" ], "github_reviewed": true, "github_reviewed_at": "2021-12-18T17:59:37Z", "nvd_published_at": "2021-12-18T12:15:00Z", "severity": "HIGH" }, "details": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.", "id": "GHSA-p6xc-xr62-6r2g", "modified": "2026-06-09T10:30:14.432177927Z", "published": "2021-12-18T18:00:07Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105" }, { "type": "WEB", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1541" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5024" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20211218-0001" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/19/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-vc5p-v9hr-52mj/GHSA-vc5p-v9hr-52mj.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta9" }, { "fixed": "2.25.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.2", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.3", "2.3.1", "2.3.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] } ], "aliases": [ "CVE-2025-68161" ], "database_specific": { "cwe_ids": [ "CWE-297" ], "github_reviewed": true, "github_reviewed_at": "2025-12-19T22:08:02Z", "nvd_published_at": "2025-12-18T21:15:57Z", "severity": "MODERATE" }, "details": "The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) configuration attribute or the [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n * The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.", "id": "GHSA-vc5p-v9hr-52mj", "modified": "2026-09-10T03:50:32.126499218Z", "published": "2025-12-18T21:31:44Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68161" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4002" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2025-68161" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/12/18/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j does not verify the TLS hostname in its Socket Appender" } ] } ] } ], "experimental_config": { "licenses": { "summary": false, "allowlist": null } }, "image_metadata": { "os": "", "layer_metadata": [ { "diff_id": "sha256:44c5e1c1219299b12cf8e91dd22d808f7f0b9a00e7d1026cebac7b559c753851", "command": "COPY log4j-core-2.14.1.jar /app/log4j-core-2.14.1.jar # buildkit", "is_empty": false, "base_image_index": 0 } ], "base_images": [ [] ] } }