CISA Log4j (CVE-2021-44228) Vulnerability Guidance

This repository provides CISA's guidance and an overview of related software regarding the Log4j vulnerability (CVE-2021-44228). CISA encourages users and administrators to review the official Apache release and upgrade to Log4j 2.15.0 or apply the recommended mitigations immediately.

Official CISA Guidance & Resources

CISA Current Activity Alerts

National Vulnerability Database (NVD) Information: CVE-2021-44228

CISA will maintain a list of all publicly available information and vendor-supplied advisories regarding the Log4j vulnerability. This list is not a full list and will be updated continuously. If you have any additional information to share relevant to the Log4j vulnerability, please feel free to open an issue here. We have a template available for your submission. Please also feel free to submit a pull request.

Mitigation Guidance

CISA urges organizations operating products marked as "Fixed" to immediately implement listed patches/mitigations here.

CISA urges organizations operating products marked as "Not Fixed" to immediately implement alternate controls, including:

Install a WAF with rules that automatically update.
Set log4j2.formatMsgNoLookups to true by adding -Dlog4j2.formatMsgNoLookups=True to the Java Virtual Machine command for starting your application.
Ensure that any alerts from a vulnerable device are immediately actioned.
Report incidents promptly to CISA and/or the FBI here.

Status Descriptions

Status Description

Unknown Status unknown. Default choice.

Affected Reported to be affected by CVE-2021-44228.

Not Affected Reported to NOT be affected by CVE-2021-44228 and no further action necessary.

Fixed Patch and/or mitigations available (see provided links).

Under Investigation Vendor investigating status.

Software List

This list was initially populated using information from the following sources:

Kevin Beaumont

Vendor Product Version(s) Status Update available Vendor link Notes Other References Last Updated

3M Health Information Systems CGS

Affected Unknown CGS: Log4j Software Update(login required) This advisory is available to customers only and has not been reviewed by CISA.

12/15/2021

Akamai SIEM Splunk Connector All Affected

GitHub - akamai/siem-splunk-connector: Akamai SIEM Connector for Splunk

Amazon OpenSearch Unknown Affected Yes (R20211203-P2) Apache Log4j2 Security Bulletin (CVE-2021-44228) (amazon.com)

Amazon AWS Lambda Unknown Affected Yes Apache Log4j2 Security Bulletin (CVE-2021-44228) (amazon.com)

Amazon AWS CloudHSM < 3.4.1. Affected

Apache Log4j2 Security Bulletin (CVE-2021-44228) (amazon.com)

Amazon EC2 Amazon Linux 1 & 2 Unknown

Apache Log4j2 Security Bulletin (CVE-2021-44228) (amazon.com)

Apache Druid < druid 0.22.0 Affected Yes Release druid-0.22.1 · apache/druid · GitHub

12/12/2021

Apache Flink < flink 1.15.0, 1.14.1, 1.13.3 Affected No Apache Flink: Advise on Apache Log4j Zero Day (CVE-2021-44228)

12/12/2021

Apache Log4j < 2.15.0 Affected Yes Log4j – Apache Log4j Security Vulnerabilities

Apache Kafka Unknown Affected No Log4j – Apache Log4j Security Vulnerabilities Only vulnerable in certain configuration(s)

Apache SOLR 7.4.0 to 7.7.3, 8.0.0 to 8.11.0 Affected Yes Log4j – Apache Log4j Security Vulnerabilities

Apereo CAS 6.3.x & 6.4.x Affected Yes CAS Log4J Vulnerability Disclosure – Apereo Community Blog

Apereo Opencast < 9.10, < 10.6 Affected Yes Apache Log4j Remote Code Execution · Advisory · opencast/opencast · GitHub

Application Performance Ltd DBMarlin Not Affected

Common Vulnerabilities Apache log4j Vulnerability CVE-2021-4428

12/15/2021

Aptible Aptible ElasticSearch 5.x Affected Yes Aptible Status - Log4j security incident CVE-2021-27135

Atlassian Jira Server & Data Center All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation You can check if you are vulnerable by inspecting the Log4j configuration file. If you find a line containing the org.apache.log4j.net.JMSAppender,

Atlassian Confluence Server & Data Center All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation You can check if you are vulnerable by inspecting the Log4j configuration file. If you find a line containing the org.apache.log4j.net.JMSAppender,

Atlassian Bamboo Server & Data Center All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation So far, we do not believe our on-premises products are vulnerable to exploitation in their default configuration. However, if a you have modified the default logging configuration (log4j.properties) to enable the JMS Appender functionality, remote code execution may be possible

Atlassian Crowd Server & Data Center All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation So far, we do not believe our on-premises products are vulnerable to exploitation in their default configuration. However, if a you have modified the default logging configuration (log4j.properties) to enable the JMS Appender functionality, remote code execution may be possible

Atlassian Fisheye All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation So far, we do not believe our on-premises products are vulnerable to exploitation in their default configuration. However, if a you have modified the default logging configuration (log4j.properties) to enable the JMS Appender functionality, remote code execution may be possible

Atlassian Crucible All Affected Yes FAQ for CVE-2021-44228 Atlassian Support Atlassian Documentation

Avaya Avaya Analytics 3.5, 3.6, 3.6.1, 3.7, 4 Affected No Apache Log4J Vulnerability - Impact for Avaya products Avaya Product Security