Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 100.0%; technical severity is CVSS 9.0.
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Who should care
- Teams operating Log4j, Log4j2, Computer Vision Annotation Tool +53 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Log4j, Log4j2, Computer Vision Annotation Tool +53 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Apply updates per vendor instructions.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- CWE
- CWE-917
- Affected versions
- Apache Log4j (Version: 2.0); Apache Log4j2; Cvat Computer Vision Annotation Tool (Version: -); Debian Debian Linux (Version: 11.0); Fedoraproject Fedora (Version: 35); Intel Audio Development Kit (Version: -); Intel Datacenter Manager (Version: -); Intel Genomics Kernel Library (Version: -)
- Published
- 14 December 2021
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 100.0%
- Signal calculated at 87
External references
- Government advisory from www.cisa.gov
- Mitigation guidance from www.openwall.com
- Third-party advisory from www.openwall.com
- Third-party advisory from www.openwall.com
- Third-party advisory from cert-portal.siemens.com
- Third-party advisory from cert-portal.siemens.com
- Third-party advisory from cert-portal.siemens.com
- Third-party advisory from cert-portal.siemens.com
- Release notes from lists.fedoraproject.org
- Release notes from lists.fedoraproject.org
- Release notes from logging.apache.org
- Third-party advisory from psirt.global.sonicwall.com