CVE catalog

CVE-2021-44832

apache-log4j2 affected and fixed versions

[CVE catalog]

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Severity
Medium · CVSS 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
97.91% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debiantrixieapache-log4j22.19.0-2Fixed[CVE-2021-44832]
Debiansidapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debiansidapache-log4j22.26.1-1Fixed[CVE-2021-44832]
Debianforkyapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debianforkyapache-log4j22.19.0-2Fixed[CVE-2021-44832]
Debianbookwormapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debianbookwormapache-log4j22.19.0-2Fixed[CVE-2021-44832]

Showing 8 fix observations. All 22 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debianbookwormapache-log4j22.19.0-2Fixed[CVE-2021-44832]
Debianforkyapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debianforkyapache-log4j22.19.0-2Fixed[CVE-2021-44832]
Debiansidapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debiansidapache-log4j22.26.1-1Fixed[CVE-2021-44832]
Debiantrixieapache-log4j22.17.1-1FixedDistribution-reported fixed boundary[CVE-2021-44832]
Debiantrixieapache-log4j22.19.0-2Fixed[CVE-2021-44832]
Opensuseleap 15.2log4j2.17.0-lp152.3.15.1UnknownSource applicability is not established[OPENSUSE-SU-2022:0002-1]
Opensuseleap 15.3log4j2.17.0-4.16.1UnknownSource applicability is not established[OPENSUSE-SU-2021:4208-1]
Ubuntu18.04apache-log4j22.10.0-1UnknownSource applicability is not established[USN-5222-1]
Ubuntu18.04apache-log4j22.10.0-2UnknownSource applicability is not established[USN-5222-1]
Ubuntu18.04apache-log4j22.10.0-2ubuntu0.1UnknownSource applicability is not established[USN-5222-1]
Ubuntu18.04apache-log4j22.12.4-0ubuntu0.1UnknownSource applicability is not established[USN-5222-1]
Ubuntu18.04apache-log4j22.8.2-1UnknownSource applicability is not established[USN-5222-1]
Ubuntu18.04apache-log4j22.8.2-2UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.11.1-2UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.11.2-1UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.15.0-0.20.04.1UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.16.0-0.20.04.1UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.17.0-0.20.04.1UnknownSource applicability is not established[USN-5222-1]
Ubuntu20.04apache-log4j22.17.1-0.20.04.1UnknownSource applicability is not established[USN-5222-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "apache-log4j2",
      "status": "fixed",
      "release": "sid",
      "version": "2.26.1-1"
    },
    {
      "name": "apache-log4j2",
      "status": "fixed",
      "release": "forky",
      "version": "2.19.0-2"
    },
    {
      "name": "apache-log4j2",
      "status": "fixed",
      "release": "trixie",
      "version": "2.19.0-2"
    },
    {
      "name": "apache-log4j2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.19.0-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1002813,
      "name": "apache-log4j2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.17.1-1"
    },
    {
      "bug": 1002813,
      "name": "apache-log4j2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.17.1-1"
    },
    {
      "bug": 1002813,
      "name": "apache-log4j2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.17.1-1"
    },
    {
      "bug": 1002813,
      "name": "apache-log4j2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.17.1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "apache-log4j2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.4-0ubuntu0.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.8.2-1",
        "2.8.2-2",
        "2.10.0-1",
        "2.10.0-2",
        "2.10.0-2ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5222-1",
      "fixed_version": "2.12.4-0ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5222-1",
      "provider_updated_at": "2026-06-01T07:15:29.038688533Z",
      "applicability_unknown": true
    },
    {
      "name": "apache-log4j2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.1-0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.11.1-2",
        "2.11.2-1",
        "2.15.0-0.20.04.1",
        "2.16.0-0.20.04.1",
        "2.17.0-0.20.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5222-1",
      "fixed_version": "2.17.1-0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5222-1",
      "provider_updated_at": "2026-06-01T07:15:29.038688533Z",
      "applicability_unknown": true
    },
    {
      "name": "log4j",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.0-lp152.3.15.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2022:0002-1",
      "fixed_version": "2.17.0-lp152.3.15.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2022:0002-1",
      "provider_updated_at": "2026-02-04T04:02:07.169981Z",
      "applicability_unknown": true
    },
    {
      "name": "log4j",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.0-4.16.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:4208-1",
      "fixed_version": "2.17.0-4.16.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:4208-1",
      "provider_updated_at": "2026-02-04T03:35:12.159004Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1002813]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [liblog4j2-java]Unknown

    Source package: [apache-log4j2]

    Details (2)

    • 2.19.0-2 · all · bookworm

      Fixed · Fixed: 2.17.1-1

      dsa · apache-log4j2 · debian · bookworm; dsa · apache-log4j2 · debian · 12

    • 2.19.0-2 · all · bookworm

      Fixed · Fixed: 2.17.1-1

      dsa · apache-log4j2 · debian · bookworm; dsa · apache-log4j2 · debian · 12

[Debian 13 (Trixie)]

  • [liblog4j2-java]Unknown

    Source package: [apache-log4j2]

    Details (2)

    • 2.19.0-2 · all · trixie

      Fixed · Fixed: 2.17.1-1

      dsa · apache-log4j2 · debian · 13

    • 2.19.0-2 · all · trixie

      Fixed · Fixed: 2.17.1-1

      dsa · apache-log4j2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]