# CVE-2021-44228: Apache Log4j Remote Code Execution Vulnerability

CVE-2021-44228 is fixed in 2 products on 1 platform, first by liblog4j2-java 2.10.0-2ubuntu0.1, released December 9, 2021. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on December 10, 2021, with known ransomware use. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/cve/CVE-2021-44228
- Priority: Patch now
- CVSS: 10.0 (Critical)
- EPSS: 1.0000
- CISA KEV: listed Dec 10, 2021, federal due date Dec 24, 2021, known ransomware use
- Exploited (vendor report): yes
- Publicly disclosed: yes
- Published: Dec 9, 2021
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-44228

## Description

<p>Certain versions of Apache Log4j2 are vulnerable to a remote code execution vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.</p> <p>Microsoft is not aware of any impact to the security of our enterprise services and has not experienced any degradation in the reliability or availability of those services as a result of this vulnerability.</p> <p>The Microsoft services detailed in the Security Updates table require customers to take action by downloading and installing security updates to mitigate the risks posed by this vulnerability on their deployments. Other Microsoft services require customers to apply configuration changes to mitigate the risks. These are listed in the MSRC blog:</p> <ul> <li>MSRC Blog:  <a href="https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/">Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 – Microsoft Security Response Center</a></li> </ul> <p>Additional information can be found in the Security Product Blog:</p> <ul> <li>Security Product Blog: <a href="https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/">Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation - Microsoft Security Blog</a></li> </ul> <h3 id="recommended-actions">Recommended Actions</h3> <p>The Microsoft services detailed in the <strong>Security Updates</strong> table require customers to take action by downloading and installing security updates to mitigate the risks posed by this vulnerability on their deployments. If we identify additional services which require customers to take action, we will notify them via <a href="https://ms.portal.azure.com/#blade/Microsoft_Azure_Health/AzureHealthBrowseBlade/securityAnnouncements">Azure Service Health Notifications</a>. If you are using any Microsoft services other than those explicitly listed there is no action required by you at this time.</p> <h3 id="how-to-get-notified-of-updates-to-this-cve">How to get notified of updates to this CVE</h3> <p>If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See <a href="https://technet.microsoft.com/security/dd252948">Microsoft Technical Security Notifications</a>.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apache-log4j2 Debian 11.6 (bullseye) | 2.15.0-1~deb11u1 | [DSA-5020-1](https://patchblox.com/security/data/fix/linux/dsa-5020-1.md) | Dec 11, 2021 |
| Linux | apache-log4j2 Debian 12.15 (bookworm) | 2.15.0-1 | [DEBIAN-CVE-2021-44228](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44228.md) | Dec 10, 2021 |
| Linux | apache-log4j2 Debian 13.5 (trixie) | 2.15.0-1 | [DEBIAN-CVE-2021-44228](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44228.md) | Dec 10, 2021 |
| Linux | apache-log4j2 Debian 14 | 2.15.0-1 | [DEBIAN-CVE-2021-44228](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44228.md) | Dec 10, 2021 |
| Linux | liblog4j2-java Ubuntu 18.04.6 LTS (bionic) | 2.10.0-2ubuntu0.1 | [liblog4j2-java 2.10.0-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-liblog4j2-java-2.10.0-2ubuntu0.1.md) | Dec 9, 2021 |
| Linux | liblog4j2-java Ubuntu 20.04 LTS (focal) | 2.15.0-0.20.04.1 | [liblog4j2-java 2.15.0-0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-liblog4j2-java-2.15.0-0.20.04.1.md) | Dec 9, 2021 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.