CriticalFix available

Incomplete fix for Apache Log4j vulnerability

Type: advisorySource: OSVKnown exploited1 source record

# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.

Announced 14 Dec 2021Source revision 1

Original source ↗

GHSA-7rjr-3q55-vv33

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-7rjr-3q55-vv33

org.apache.logging.log4j:log4j-core

Source reference: /affected/0/package/name

Affected versions: 2.13.0
Source reference: /affected/0/versions
2.13.1
Source reference: /affected/0/versions
2.13.2
Source reference: /affected/0/versions
2.13.3
Source reference: /affected/0/versions
2.14.0
Source reference: /affected/0/versions
2.14.1
Source reference: /affected/0/versions
2.15.0
Source reference: /affected/0/versions
Fixed versions: 2.16.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

org.apache.logging.log4j:log4j-core

Source reference: /affected/1/package/name

Affected versions: 2.10.0
Source reference: /affected/1/versions
2.11.0
Source reference: /affected/1/versions
2.11.1
Source reference: /affected/1/versions
2.11.2
Source reference: /affected/1/versions
2.12.0
Source reference: /affected/1/versions
2.12.1
Source reference: /affected/1/versions
2.4
Source reference: /affected/1/versions
2.4.1
Source reference: /affected/1/versions
2.5
Source reference: /affected/1/versions
2.6
Source reference: /affected/1/versions
2.6.1
Source reference: /affected/1/versions
2.6.2
Source reference: /affected/1/versions
2.7
Source reference: /affected/1/versions
2.8
Source reference: /affected/1/versions
2.8.1
Source reference: /affected/1/versions
2.8.2
Source reference: /affected/1/versions
2.9.0
Source reference: /affected/1/versions
2.9.1
Source reference: /affected/1/versions
Fixed versions: 2.12.2
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

org.ops4j.pax.logging:pax-logging-log4j2

Source reference: /affected/2/package/name

Affected versions: 1.8.0
Source reference: /affected/2/versions
1.8.1
Source reference: /affected/2/versions
1.8.2
Source reference: /affected/2/versions
1.8.3
Source reference: /affected/2/versions
1.8.4
Source reference: /affected/2/versions
1.8.5
Source reference: /affected/2/versions
1.8.6
Source reference: /affected/2/versions
1.8.7
Source reference: /affected/2/versions
1.9.0
Source reference: /affected/2/versions
1.9.1
Source reference: /affected/2/versions
Fixed versions: 1.9.2
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

org.ops4j.pax.logging:pax-logging-log4j2

Source reference: /affected/3/package/name

Affected versions: 1.10.0
Source reference: /affected/3/versions
1.10.1
Source reference: /affected/3/versions
1.10.2
Source reference: /affected/3/versions
1.10.3
Source reference: /affected/3/versions
1.10.4
Source reference: /affected/3/versions
1.10.5
Source reference: /affected/3/versions
1.10.6
Source reference: /affected/3/versions
1.10.7
Source reference: /affected/3/versions
Fixed versions: 1.10.8
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

org.ops4j.pax.logging:pax-logging-log4j2

Source reference: /affected/4/package/name

Affected versions: 1.11.0
Source reference: /affected/4/versions
1.11.1
Source reference: /affected/4/versions
1.11.10
Source reference: /affected/4/versions
1.11.2
Source reference: /affected/4/versions
1.11.3
Source reference: /affected/4/versions
1.11.4
Source reference: /affected/4/versions
1.11.5
Source reference: /affected/4/versions
1.11.6
Source reference: /affected/4/versions
1.11.7
Source reference: /affected/4/versions
1.11.8
Source reference: /affected/4/versions
1.11.9
Source reference: /affected/4/versions
Fixed versions: 1.11.11
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

org.ops4j.pax.logging:pax-logging-log4j2

Source reference: /affected/5/package/name

Affected versions: 2.0.0
Source reference: /affected/5/versions
2.0.1
Source reference: /affected/5/versions
2.0.10
Source reference: /affected/5/versions
2.0.11
Source reference: /affected/5/versions
2.0.2
Source reference: /affected/5/versions
2.0.3
Source reference: /affected/5/versions
2.0.4
Source reference: /affected/5/versions
2.0.5
Source reference: /affected/5/versions
2.0.6
Source reference: /affected/5/versions
2.0.7
Source reference: /affected/5/versions
2.0.8
Source reference: /affected/5/versions
2.0.9
Source reference: /affected/5/versions
Fixed versions: 2.0.12
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

org.apache.logging.log4j:log4j-core

Source reference: /affected/6/package/name

Affected versions: 2.0
Source reference: /affected/6/versions
2.0-alpha1
Source reference: /affected/6/versions
2.0-alpha2
Source reference: /affected/6/versions
2.0-beta1
Source reference: /affected/6/versions
2.0-beta2
Source reference: /affected/6/versions
2.0-beta3
Source reference: /affected/6/versions
2.0-beta4
Source reference: /affected/6/versions
2.0-beta5
Source reference: /affected/6/versions
2.0-beta6
Source reference: /affected/6/versions
2.0-beta7
Source reference: /affected/6/versions
2.0-beta8
Source reference: /affected/6/versions
2.0-beta9
Source reference: /affected/6/versions
2.0-rc1
Source reference: /affected/6/versions
2.0-rc2
Source reference: /affected/6/versions
2.0.1
Source reference: /affected/6/versions
2.0.2
Source reference: /affected/6/versions
2.1
Source reference: /affected/6/versions
2.2
Source reference: /affected/6/versions
2.3
Source reference: /affected/6/versions
Fixed versions: 2.3.1
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.13.0"
          },
          {
            "fixed": "2.16.0"
          }
        ]
      }
    ],
    "package": {
      "name": "org.apache.logging.log4j:log4j-core",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core",
      "ecosystem": "Maven"
    },
    "versions": [
      "2.13.0",
      "2.13.1",
      "2.13.2",
      "2.13.3",
      "2.14.0",
      "2.14.1",
      "2.15.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.4.0"
          },
          {
            "fixed": "2.12.2"
          }
        ]
      }
    ],
    "package": {
      "name": "org.apache.logging.log4j:log4j-core",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core",
      "ecosystem": "Maven"
    },
    "versions": [
      "2.10.0",
      "2.11.0",
      "2.11.1",
      "2.11.2",
      "2.12.0",
      "2.12.1",
      "2.4",
      "2.4.1",
      "2.5",
      "2.6",
      "2.6.1",
      "2.6.2",
      "2.7",
      "2.8",
      "2.8.1",
      "2.8.2",
      "2.9.0",
      "2.9.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.8.0"
          },
          {
            "fixed": "1.9.2"
          }
        ]
      }
    ],
    "package": {
      "name": "org.ops4j.pax.logging:pax-logging-log4j2",
      "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.8.0",
      "1.8.1",
      "1.8.2",
      "1.8.3",
      "1.8.4",
      "1.8.5",
      "1.8.6",
      "1.8.7",
      "1.9.0",
      "1.9.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.10.0"
          },
          {
            "fixed": "1.10.8"
          }
        ]
      }
    ],
    "package": {
      "name": "org.ops4j.pax.logging:pax-logging-log4j2",
      "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.10.0",
      "1.10.1",
      "1.10.2",
      "1.10.3",
      "1.10.4",
      "1.10.5",
      "1.10.6",
      "1.10.7"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.11.0"
          },
          {
            "fixed": "1.11.11"
          }
        ]
      }
    ],
    "package": {
      "name": "org.ops4j.pax.logging:pax-logging-log4j2",
      "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.11.0",
      "1.11.1",
      "1.11.10",
      "1.11.2",
      "1.11.3",
      "1.11.4",
      "1.11.5",
      "1.11.6",
      "1.11.7",
      "1.11.8",
      "1.11.9"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.0.0"
          },
          {
            "fixed": "2.0.12"
          }
        ]
      }
    ],
    "package": {
      "name": "org.ops4j.pax.logging:pax-logging-log4j2",
      "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
      "ecosystem": "Maven"
    },
    "versions": [
      "2.0.0",
      "2.0.1",
      "2.0.10",
      "2.0.11",
      "2.0.2",
      "2.0.3",
      "2.0.4",
      "2.0.5",
      "2.0.6",
      "2.0.7",
      "2.0.8",
      "2.0.9"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.1"
          }
        ]
      }
    ],
    "package": {
      "name": "org.apache.logging.log4j:log4j-core",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core",
      "ecosystem": "Maven"
    },
    "versions": [
      "2.0",
      "2.0-alpha1",
      "2.0-alpha2",
      "2.0-beta1",
      "2.0-beta2",
      "2.0-beta3",
      "2.0-beta4",
      "2.0-beta5",
      "2.0-beta6",
      "2.0-beta7",
      "2.0-beta8",
      "2.0-beta9",
      "2.0-rc1",
      "2.0-rc2",
      "2.0.1",
      "2.0.2",
      "2.1",
      "2.2",
      "2.3"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
    }
  }
]

Related CVEs: CVE-2021-45046
Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2021-45046 · Unrated

Log4j2 · Known exploited (CISA KEV)

Event: #71350 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 22:46:02 GMT
Publisher date: Tue, 14 Dec 2021 18:01:28 GMT

Read the original announcement