Log4Shell: CVE-2021-44228 in Apache Log4j

Code execution through a single log message in Apache Log4j 2, rated CVSS 10.0.

Published in the NVD on 10/12/2021

CVE-2021-44228

CVSS 3.1: 10.0 (critical) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 10/12/2021

Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 100.000

What is Log4Shell?

Log4Shell is a flaw in Apache Log4j 2. JNDI lookups in the configuration, in log messages and in parameters were not protected against attacker-controlled LDAP and other JNDI endpoints. Whoever can control a log message or one of its parameters can make the application load and run code from an LDAP server, as long as message lookup substitution is enabled.

The NVD rates it at CVSS 10.0, and CISA has listed it as actively exploited since 10 December 2021. Log4j sits inside many Java applications, often as a dependency of a dependency.

Affected and fixed versions

Apache Log4j 2

Affected: 2.13.0 - 2.14.1

Fixed in 2.15.0

Apache Log4j 2

Affected: 2.4.0 - 2.12.1

Fixed in 2.12.2

Apache Log4j 2

Affected: 2.0-beta9 - 2.3.0

Fixed in 2.3.1

All branches and vulnerabilities of Apache Log4j

Status in Debian and Ubuntu

Debian 12: apache-log4j2

Fixed

Fixed from package version 2.15.0-1

Debian 13: apache-log4j2

Fixed

Fixed from package version 2.15.0-1

Ubuntu 18.04 LTS: apache-log4j2

Fixed

Fixed from package version 2.10.0-2ubuntu0.1

Ubuntu 20.04 LTS: apache-log4j2

Fixed

Fixed from package version 2.15.0-0.20.04.1

What to do

Update Log4j 2 to 2.15.0 or later, on the 2.12 branch to 2.12.2 and on the 2.3 branch to 2.3.1. From 2.16.0, and in 2.12.2, 2.12.3 and 2.3.1, the feature has been removed entirely. Also check the Log4j versions that your Java applications bring along.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch Apache Log4j

Watch apache-log4j2 (Debian 12)

Already have an account? Log in and add Apache Log4j