Apache Log4j2 Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/12/2021. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| com.guicedee.services:log4j-core | ≤ 1.2.1.2-jre17 | |
| org.apache.logging.log4j:log4j-core | ≥ 2.0-beta9, < 2.3.1≥ 2.13.0, < 2.15.0≥ 2.4, < 2.12.2 | 2.3.12.15.02.12.2 |
| org.ops4j.pax.logging:pax-logging-log4j2 | ≥ 1.10.0, < 1.10.8≥ 1.11.0, < 1.11.10≥ 1.8.0, < 1.9.2≥ 2.0.0, < 2.0.11 | 1.10.81.11.101.9.22.0.11 |
| org.xbib.elasticsearch:log4j | = 6.3.2.1 | |
| uk.co.nichesolutions.logging.log4j:log4j-core | = 2.6.3-CUSTOM | |
| log4j | = 2.0≥ 2.0.1, < 2.3.1≥ 2.13.0, < 2.15.0≥ 2.4.0, < 2.12.2 | 2.3.12.15.02.12.2 |
| xcode | < 13.3 | 13.3 |
| synchro | ≥ 6.1, < 6.2.4.2 | 6.2.4.2 |
| synchro 4d | < 6.4.3.2 | 6.4.3.2 |
| advanced malware protection virtual private cloud appliance | < 3.5.4 | 3.5.4 |
| automated subsea tuning | = 02.01.00< 2.1.0 | 2.1.0 |
| broadworks | < 2021.11_1.162 | 2021.11_1.162 |
| business process automation | ≥ 3.1.000.000, < 3.1.000.044≥ 3.2.000.000, < 3.2.000.009< 3.0.000.115 | 3.1.000.0443.2.000.0093.0.000.115 |
| cloud connect | < 12.6\(1\) | 12.6\(1\) |
| cloudcenter | < 4.10.0.16 | 4.10.0.16 |
| cloudcenter cost optimizer | < 5.5.2 | 5.5.2 |
| cloudcenter suite | = 4.10.0.15= 5.3.0= 5.4.1= 5.5.0= 5.5.1 | |
| cloudcenter suite admin | < 5.3.1 | 5.3.1 |
| cloudcenter workload manager | < 5.5.2 | 5.5.2 |
| common services platform collector | = 002.009(000.000)= 002.009(000.001)= 002.009(000.002)= 002.009(001.000)= 002.009(001.001)= 002.009(001.002)= 002.010(000.000)≥ 2.10.0, < 2.10.0.1< 2.9.1.3 | 2.10.0.12.9.1.3 |
| contact center domain manager | < 12.5\(1\) | 12.5\(1\) |
| contact center management portal | < 12.5\(1\) | 12.5\(1\) |
| crosswork data gateway | = 3.0.0< 2.0.2 | 2.0.2 |
| crosswork network automation | = 2.0.0= 3.0.0= 4.1.0= 4.1.1 | |
| crosswork network controller | = 3.0.0< 2.0.1 | 2.0.1 |
| crosswork optimization engine | = 3.0.0< 2.0.1 | 2.0.1 |
| crosswork platform infrastructure | = 4.1.0< 4.0.1 | 4.0.1 |
| crosswork zero touch provisioning | = 3.0.0< 2.0.1 | 2.0.1 |
| customer experience cloud agent | < 1.12.1 | 1.12.1 |
| cx cloud agent | = 001.012 | |
| cyber vision | = 4.0.2 | |
| cyber vision sensor management extension | = 4.0.2< 4.0.3 | 4.0.3 |
| data center network manager | = 11.3(1)< 11.3\(1\) | 11.3\(1\) |
| dna center | = 2.2.2.8≥ 2.2.2.0, < 2.2.2.8≥ 2.2.3.0, < 2.2.3.4< 2.1.2.8 | 2.2.2.82.2.3.42.1.2.8 |
| dna spaces | < 2.5 | 2.5 |
| emergency responder | = 11.5= 11.5(4.65000.14)= 11.5(4.66000.14)< 11.5\(4\) | 11.5\(4\) |
| enterprise chat and email | = 12.0(1)= 12.5(1)= 12.6(1)< 12.0\(1\) | 12.0\(1\) |
| evolved programmable network manager | = 3.0= 3.1= 4.0= 4.1= 5.0= 5.1≤ 4.1.1 | |
| finesse | = 12.5(1)= 12.6(1)< 12.6\(1\) | 12.6\(1\) |
| identity services engine | = 002.004(000.914)= 002.006(000.156)= 002.007(000.356)= 003.000(000.458)= 003.001(000.518)= 003.002(000.116)= 2.4.0< 2.4.0 | 2.4.0 |
| integrated management controller supervisor | = 002.003(002.000)= 2.3.2.0< 2.3.2.1 | 2.3.2.1 |
| intersight virtual appliance | = 1.0.9-343< 1.0.9-361 | 1.0.9-361 |
| network assurance engine | = 6.0(2.1912)< 6.0.2 | 6.0.2 |
| network dashboard fabric controller | = 11.0(1)= 11.1(1)= 11.2(1)= 11.3(1)= 11.4(1)= 11.5(1)= 11.5(2)= 11.5(3) | |
| network insights for data center | = 6.0(2.1914) | |
| network services orchestrator | ≥ 5.4, < 5.4.5.2≥ 5.5, < 5.5.4.1≥ 5.6, < 5.6.3.1< 5.3.5.1 | 5.4.5.25.5.4.15.6.3.15.3.5.1 |
| nexus dashboard | < 2.1.2 | 2.1.2 |
| nexus insights | < 6.0.2 | 6.0.2 |
| optical network controller | = 1.1< 1.1.0 | 1.1.0 |
| packaged contact center enterprise | = 11.6(1)< 11.6 | 11.6 |
| paging server | = 12.5(2)= 14.0(1)= 8.3(1)= 8.4(1)= 8.5(1)= 9.0(1)= 9.0(2)= 9.1(1)< 14.4.1 | 14.4.1 |
| prime service catalog | = 12.1< 12.1 | 12.1 |
| sd-wan vmanage | = 20.3= 20.4= 20.5= 20.6= 20.6.1= 20.7= 20.8≥ 20.4, < 20.4.2.1≥ 20.5, < 20.5.1.1≥ 20.6, < 20.6.2.1< 20.3.4.1 | 20.4.2.120.5.1.120.6.2.120.3.4.1 |
| secure firewall threat defense | = 6.2.3= 6.3.0= 6.4.0= 6.5.0= 6.6.0= 6.7.0= 7.0.0= 7.1.0 | |
| smart phy | = 21.3= 3.1.2= 3.1.3= 3.1.4= 3.1.5= 3.2.1< 3.2.1 | 3.2.1 |
| ucs central | < 2.0\(1p\) | 2.0\(1p\) |
| ucs central software | = 2.0= 2.0(1a)= 2.0(1b)= 2.0(1c)= 2.0(1d)= 2.0(1e)= 2.0(1f)= 2.0(1g)= 2.0(1h)= 2.0(1k)= 2.0(1l) | |
| ucs director | < 6.8.2.0 | 6.8.2.0 |
| unified communications manager | = 11.5(1)= 11.5(1)su3= 11.5(1.17900.52)= 11.5(1.18119.2)= 11.5(1.18900.97)= 11.5(1.21900.40)= 11.5(1.22900.28)< 11.5\(1\) | 11.5\(1\) |
| unified communications manager im & presence service | = 11.5(1)= 11.5(1.22900.6) | |
| unified communications manager im and presence service | = 11.5(1)< 11.5\(1\) | 11.5\(1\) |
| unified computing system | = 006.008(001.000) | |
| unified contact center enterprise | = 11.6(2)= 12.0(1)= 12.5(1)= 12.6(1)= 12.6(2)< 11.6\(2\) | 11.6\(2\) |
| unified contact center express | = 12.5(1)= 12.6(1)= 12.6(2)< 12.5\(1\) | 12.5\(1\) |
| unified contact center management portal | = 12.6(1) | |
| unified customer voice portal | = 11.6= 11.6(1)= 12.0= 12.0(1)= 12.5= 12.5(1)= 12.6(1)< 11.6 | 11.6 |
| unified intelligence center | = 12.6(1)= 12.6(2)< 12.6\(1\) | 12.6\(1\) |
| unified sip proxy | = 010.000(000)= 010.000(001)= 010.002(000)= 010.002(001) | |
| unified workforce optimization | = 11.5(1) | |
| unity connection | = 11.5= 11.5(1.10000.6)< 11.5\(1\) | 11.5\(1\) |
| video surveillance manager | = 7.14(1.26)= 7.14(2.26)= 7.14(3.025)= 7.14(4.018) | |
| video surveillance operations manager | < 7.14.4 | 7.14.4 |
| virtual topology system | = 2.6.6< 2.6.7 | 2.6.7 |
| virtualized infrastructure manager | ≥ 3.4.0, < 3.4.4< 3.2.0 | 3.4.43.2.0 |
| virtualized voice browser | < 12.5\(1\) | 12.5\(1\) |
| wan automation engine | = 7.1.3= 7.2.1= 7.2.2= 7.2.3= 7.3= 7.4= 7.5= 7.6< 7.3.0.2 | 7.3.0.2 |
| webex meetings server | = 3.0= 4.0< 3.0 | 3.0 |
| workload optimization manager | < 3.2.1 | 3.2.1 |
| datacenter manager | < 5.1 | 5.1 |
| rhythmyx | ≤ 7.3.2 | |
| capital | = 2019.1< 2019.1 | 2019.1 |
| comos | < 10.4.2 | 10.4.2 |
| desigo cc advanced reports | = 3.0= 4.0= 4.1= 4.2= 5.0= 5.1 | |
| desigo cc info center | = 5.0= 5.1 | |
| e-car operation center | < 2021-12-13 | 2021-12-13 |
| energy engage | = 3.1 | |
| energyip | = 8.5= 8.6= 8.7= 9.0 | |
| energyip prepay | < 3.8.0.12 | 3.8.0.12 |
| gma-manager | < 8.6.2j-398 | 8.6.2j-398 |
| industrial edge management hub | < 2021-12-13 | 2021-12-13 |
| mindsphere | < 2021-12-16 | 2021-12-16 |
| navigator | < 2021-12-13 | 2021-12-13 |
| opcenter intelligence | ≥ 3.2, < 3.5 | 3.5 |
| operation scheduler | ≤ 1.1.3 | |
| sentron powermanager | = 4.1= 4.2 | |
| siguard dsa | ≥ 4.2, < 4.4.1 | 4.4.1 |
| sipass integrated | = 2.80= 2.85 | |
| siveillance command | ≤ 4.16.2.1 | |
| siveillance identity | = 1.5= 1.6 | |
| solid edge harness design | = 2020< 2020 | 2020 |
| spectrum power 4 | = 4.70< 4.70 | 4.70 |
| spectrum power 7 | = 2.30< 2.30 | 2.30 |
| vesys | = 2019.1= 2020.1= 2021.1< 2019.1 | 2019.1 |
| snow commander | < 8.10.0 | 8.10.0 |
| vm access proxy | < 3.6 | 3.6 |
| email security | < 10.0.13 | 10.0.13 |
Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per Apache's Log4j security guide: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.
Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the Updated advice for version 2.16.0 section of this advisory.
Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.
Any Log4J version prior to v2.15.0 is affected to this specific issue.
The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.
Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3
Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.
The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which disables JNDI by default and completely removes support for message lookups. Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as CVE-2021-45046. More information is available on the GitHub Security Advisory for CVE-2021-45046.
Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded.
Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free