{ "cveId": "CVE-2021-44228", "url": "https://patchblox.com/security/cve/CVE-2021-44228", "summary": "CVE-2021-44228 is fixed in 2 products on 1 platform, first by liblog4j2-java 2.10.0-2ubuntu0.1, released December 9, 2021. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on December 10, 2021, with known ransomware use. Patch Radar priority: Patch now.", "title": "Apache Log4j Remote Code Execution Vulnerability", "description": "\u003Cp\u003ECertain versions of Apache Log4j2 are vulnerable to a remote code execution vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.\u003C/p\u003E\n\u003Cp\u003EMicrosoft is not aware of any impact to the security of our enterprise services and has not experienced any degradation in the reliability or availability of those services as a result of this vulnerability.\u003C/p\u003E\n\u003Cp\u003EThe Microsoft services detailed in the Security Updates table require customers to take action by downloading and installing security updates to mitigate the risks posed by this vulnerability on their deployments. Other Microsoft services require customers to apply configuration changes to mitigate the risks. These are listed in the MSRC blog:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EMSRC Blog: \u003Ca href=\u0022https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/\u0022\u003EMicrosoft\u2019s Response to CVE-2021-44228 Apache Log4j 2 \u2013 Microsoft Security Response Center\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAdditional information can be found in the Security Product Blog:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ESecurity Product Blog: \u003Ca href=\u0022https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/\u0022\u003EGuidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation - Microsoft Security Blog\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch3 id=\u0022recommended-actions\u0022\u003ERecommended Actions\u003C/h3\u003E\n\u003Cp\u003EThe Microsoft services detailed in the \u003Cstrong\u003ESecurity Updates\u003C/strong\u003E table require customers to take action by downloading and installing security updates to mitigate the risks posed by this vulnerability on their deployments. If we identify additional services which require customers to take action, we will notify them via \u003Ca href=\u0022https://ms.portal.azure.com/#blade/Microsoft_Azure_Health/AzureHealthBrowseBlade/securityAnnouncements\u0022\u003EAzure Service Health Notifications\u003C/a\u003E. If you are using any Microsoft services other than those explicitly listed there is no action required by you at this time.\u003C/p\u003E\n\u003Ch3 id=\u0022how-to-get-notified-of-updates-to-this-cve\u0022\u003EHow to get notified of updates to this CVE\u003C/h3\u003E\n\u003Cp\u003EIf you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See \u003Ca href=\u0022https://technet.microsoft.com/security/dd252948\u0022\u003EMicrosoft Technical Security Notifications\u003C/a\u003E.\u003C/p\u003E", "published": "2021-12-09T16:00:00Z", "severity": "Critical", "cvss": 10, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "epss": 0.99999, "epssPercentile": 1, "priority": "Patch now", "priorityTier": 1, "exploited": true, "vendorExploited": true, "disclosed": true, "kev": { "added": "2021-12-10T00:00:00Z", "due": "2021-12-24T00:00:00Z", "ransomware": true, "requiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available." }, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-44228", "fixes": [ { "platform": "linux", "product": "apache-log4j2", "release": "Debian 11.6 (bullseye)", "fixedVersion": "2.15.0-1~deb11u1", "fix": "DSA-5020-1", "url": "https://patchblox.com/security/fix/linux/dsa-5020-1", "released": "2021-12-11T00:00:00Z" }, { "platform": "linux", "product": "apache-log4j2", "release": "Debian 12.15 (bookworm)", "fixedVersion": "2.15.0-1", "fix": "DEBIAN-CVE-2021-44228", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44228", "released": "2021-12-10T10:15:09Z" }, { "platform": "linux", "product": "apache-log4j2", "release": "Debian 13.5 (trixie)", "fixedVersion": "2.15.0-1", "fix": "DEBIAN-CVE-2021-44228", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44228", "released": "2021-12-10T10:15:09Z" }, { "platform": "linux", "product": "apache-log4j2", "release": "Debian 14", "fixedVersion": "2.15.0-1", "fix": "DEBIAN-CVE-2021-44228", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44228", "released": "2021-12-10T10:15:09Z" }, { "platform": "linux", "product": "liblog4j2-java", "release": "Ubuntu 18.04.6 LTS (bionic)", "fixedVersion": "2.10.0-2ubuntu0.1", "fix": "liblog4j2-java 2.10.0-2ubuntu0.1", "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-liblog4j2-java-2.10.0-2ubuntu0.1", "released": "2021-12-09T16:00:00Z" }, { "platform": "linux", "product": "liblog4j2-java", "release": "Ubuntu 20.04 LTS (focal)", "fixedVersion": "2.15.0-0.20.04.1", "fix": "liblog4j2-java 2.15.0-0.20.04.1", "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-liblog4j2-java-2.15.0-0.20.04.1", "released": "2021-12-09T16:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }