CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 97.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-28 · updated 2026-06-17
Weakness: CWE-20

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Affected products

Apache Log4j: from 2.0.1 before 2.3.2; from 2.4 before 2.12.4; from 2.13.0 before 2.17.1; 2.0, 2.0-beta7, 2.0-beta8, 2.0-beta9, 2.0-rc1, 2.0-rc2 — fixed in 2.12.4, 2.17.1, 2.3.2
Cisco Cloudcenter: 4.10.0.16
Debian Linux: 9.0
Fedoraproject Fedora: 34, 35
Oracle Corporation Communications BRM - Elastic Charging Engine: before 12.0.0.4.6; 12.0.0.5.0 — fixed in 12.0.0.4.6
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.5.1.0; from 8.3.0.0 through 8.5.1.0
Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
Oracle Communications Offline Mediation Controller: before 12.0.0.4.4; 12.0.0.5.0 — fixed in 12.0.0.4.4
Oracle Corporation FLEXCUBE Private Banking: 12.1.0
Oracle Corporation Health Sciences Data Management Workbench: 2.5.2.1, 3.0.0.0, 3.1.0.3
Oracle Policy Automation: from 12.2.0 through 12.2.24
Oracle Policy Automation For Mobile Devices: from 12.2.0 through 12.2.24
Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.13; from 19.12.0 through 19.12.12; from 20.12.0 through 20.12.7; 21.12.0
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 19.12.0 through 19.12.18.0; from 20.12.0.0 through 20.12.12.0; from 19.12.0.0 through 19.12.18.0; 21.12.0.0
Oracle Corporation Primavera Unifier: 18.8, 19.12, 20.12, 21.12
Oracle Corporation Oracle Product Lifecycle Analytics: 3.6.1
Oracle Retail Assortment Planning: 16.0.3
Oracle Retail Fiscal Management: 14.2
Oracle Retail Order Broker: 18.0, 19.1
Oracle Corporation Retail Xstore Point of Service: 17.0.4, 18.0.3, 19.0.2, 20.0.1, 21.0.1
Oracle Corporation Siebel UI Framework: through 21.12; 21.12
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Maven Org.Apache.Logging.Log4j:Log4j-Core: from 2.0-beta7 before 2.3.2; from 2.4 before 2.12.4; from 2.13.0 before 2.17.1; 2.0, 2.0-beta7, 2.0-beta8, 2.0-beta9, 2.0-rc1, 2.0-rc2 (+35) — fixed in 2.3.2, 2.12.4, 2.17.1
Maven Org.Ops4j.Pax.Logging:Pax-Logging-Log4j2: from 1.8.0 before 1.9.2; from 1.10.0 before 1.10.9; from 1.11.0 before 1.11.13; from 2.0.0 before 2.0.14; 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5 (+40) — fixed in 1.9.2, 1.10.9, 1.11.13, 2.0.14

How to fix

Upgrade to a fixed version: Apache Log4j 2.12.4, 2.17.1, 2.3.2; Oracle Corporation Communications BRM - Elastic Charging Engine 12.0.0.4.6; Oracle Communications Offline Mediation Controller 12.0.0.4.4; Maven Org.Apache.Logging.Log4j:Log4j-Core 2.3.2, 2.12.4, 2.17.1; Maven Org.Ops4j.Pax.Logging:Pax-Logging-Log4j2 1.9.2, 1.10.9, 1.11.13, 2.0.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-44832 or the next vulnerability affects your stack