CVE-2021-44832: Apache LOG4J

Medium severity, CVSS 6.6. EPSS: 97.9% chance of exploitation in the next 30 days.

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Affected products

Apache LOG4J: from 2.0.1, before 2.3.2 (fixed in 2.3.2); from 2.4, before 2.12.4 (fixed in 2.12.4); from 2.13.0, before 2.17.1 (fixed in 2.17.1); version 2.0 only
Cisco Cloudcenter: version 4.10.0.16 only
Debian Debian Linux: version 9.0 only
Fedoraproject Fedora: version 34 only; version 35 only
Oracle Communications Brm - Elastic Charging Engine: before 12.0.0.4.6 (fixed in 12.0.0.4.6); version 12.0.0.5.0 only
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.1.0; from 8.3.0.0, up to and including 8.5.1.0
Oracle Communications Interactive Session Recorder: version 6.3 only; version 6.4 only
Oracle Communications Offline Mediation Controller: before 12.0.0.4.4 (fixed in 12.0.0.4.4); version 12.0.0.5.0 only
Oracle Flexcube Private Banking: version 12.1.0 only
Oracle Health Sciences Data Management Workbench: version 2.5.2.1 only; version 3.0.0.0 only; version 3.1.0.3 only
Oracle Policy Automation: from 12.2.0, up to and including 12.2.24
Oracle Policy Automation For Mobile Devices: from 12.2.0, up to and including 12.2.24
Oracle Primavera Gateway: from 17.12.0, up to and including 17.12.11; from 18.8.0, up to and including 18.8.13; from 19.12.0, up to and including 19.12.12; from 20.12.0, up to and including 20.12.7; version 21.12.0 only
Oracle Primavera p6 Enterprise Project Portfolio Management: from 19.12.0, up to and including 19.12.18.0; from 20.12.0.0, up to and including 20.12.12.0; version 21.12.0.0 only; from 19.12.0.0, up to and including 19.12.18.0
Oracle Primavera Unifier: version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only
Oracle Product Lifecycle Analytics: version 3.6.1 only
Oracle Retail Assortment Planning: version 16.0.3 only
Oracle Retail Fiscal Management: version 14.2 only
Oracle Retail Order Broker: version 18.0 only; version 19.1 only
Oracle Retail Xstore Point Of Service: version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only; version 21.0.1 only
Oracle Siebel UI Framework: version 21.12 only; up to and including 21.12
Oracle WebLogic Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only; version 14.1.1.0.0 only

Published 2021-12-28. Last modified 2026-06-17.