amazon aws CVE-2021-44228 vulnerability in Amazon and Other Products
Published on December 10, 2021

product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Github Repository Github Repository Github Repository Github Repository Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Apache Log4j2 Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

The following remediation steps are recommended / required by December 24, 2021: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.g

Vulnerability Analysis

CVE-2021-44228 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2021-44228 has been classified to as a Resource Exhaustion vulnerability or weakness.

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2021-44228 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.


Products Associated with CVE-2021-44228

You can be notified by stack.watch whenever vulnerabilities like CVE-2021-44228 are published in these products:

Amazon Aws
 
Apache Log4j
 
Canonical Ubuntu Linux
 
Siemens Captial
 
Siemens Comos
 
Siemens Desigo Cc Advanced Reports
 
Siemens Desigo Cc Info Center
 
Siemens E Car Operation Center
 
Siemens Energy Engage
 
Siemens Energyip
 
Siemens Energyip Prepay
 
Siemens Gma Manager
 
Siemens Head End System Universal Device Integration System
 
Siemens Industrial Edge Management
 
Siemens Industrial Edge Management Hub
 
Siemens Logo Soft Comfort
 
Siemens Mendix
 
Siemens Mindsphere
 
Siemens Navigator
 
Siemens Nx
 
Siemens Opcenter Intelligence
 
Siemens Operation Scheduler
 
Siemens Sentron Powermanager
 
Siemens Siguard Dsa
 
Siemens Sipass Integrated
 
Siemens Siveillance Command
 
Siemens Siveillance Control Pro
 
Siemens Siveillance Identity
 
Siemens Siveillance Vantage
 
Siemens Siveillance Viewpoint
 
Siemens Solid Edge Cam Pro
 
Siemens Solid Edge Harness Design
 
Siemens Spectrum Power 4
 
Siemens Spectrum Power 7
 
Siemens Teamcenter
 
Siemens Vesys
 
Siemens Xpedition Enterprise
 
Siemens Xpedition Package Integrator
 
Intel Audio Development Kit
 
Intel Computer Vision Annotation Tool
 
Intel Data Center Manager
 
Intel Genomics Kernel Library
 
Intel Oneapi Sample Browser
 
Intel Secure Device Onboard
 
Intel Sensor Solution Firmware Development Kit
 
Intel System Debugger
 
Intel System Studio
 
Debian Linux
 
Fedora Project Fedora
 
SonicWall Email Security
 
NetApp Active Iq Unified Manager
 
NetApp Cloud Insights
 
NetApp Cloud Manager
 
NetApp Cloud Secure Agent
 
NetApp Oncommand Insight
 
NetApp Ontap Tools
 
NetApp Snapcenter
 
Cisco Advanced Malware Protection Virtual Private Cloud Appliance
 
Cisco Automated Subsea Tuning
 
Cisco Broadworks
 
Cisco Business Process Automation
 
Cisco Cloud Connect
 
Cisco Cloudcenter
 
Cisco Cloudcenter Cost Optimizer
 
Cisco Cloudcenter Suite Admin
 
Cisco Cloudcenter Workload Manager
 
Cisco Common Services Platform Collector
 
Cisco Connected Mobile Experiences
 
Cisco Contact Center Domain Manager
 
Cisco Contact Center Management Portal
 
Cisco Crosswork Data Gateway
 
Cisco Crosswork Network Controller
 
Cisco Crosswork Optimization Engine
 
Cisco Crosswork Platform Infrastructure
 
Cisco Crosswork Zero Touch Provisioning
 
Cisco Customer Experience Cloud Agent
 
Cisco Cyber Vision Sensor Management Extension
 
Cisco Data Center Network Manager
 
Cisco Dna Center
 
Cisco Dna Spaces
 
Cisco Emergency Responder
 
Cisco Enterprise Chat And Email
 
Cisco Evolved Programmable Network Manager
 
Cisco Finesse
 
Cisco Fog Director
 
Cisco Identity Services Engine
 
Cisco Integrated Management Controller Supervisor
 
Cisco Intersight Virtual Appliance
 
Cisco Iot Operations Dashboard
 
Cisco Network Assurance Engine
 
Cisco Network Services Orchestrator
 
Cisco Nexus Dashboard
 
Cisco Nexus Insights
 
Cisco Optical Network Controller
 
Cisco Packaged Contact Center Enterprise
 
Cisco Paging Server
 
Cisco Prime Service Catalog
 
Cisco Sd Wan Vmanage
 
Cisco Smart Phy
 
Cisco Ucs Central
 
Cisco Ucs Director
 
Cisco Unified Communications Manager
 
Cisco Unified Communications Manager Im Presence Service
 
Cisco Unified Contact Center Enterprise
 
Cisco Unified Contact Center Express
 
Cisco Unified Customer Voice Portal
 
Cisco Unity Connection
 
Cisco Video Surveillance Operations Manager
 
Cisco Virtual Topology System
 
Cisco Virtualized Infrastructure Manager
 
Cisco Virtualized Voice Browser
 
Cisco Wan Automation Engine
 
Cisco Webex Meetings Server
 
Cisco Workload Optimization Manager
 
Cisco Unified Intelligence Center
 
Cisco Unified Sip Proxy
 
Cisco Unified Workforce Optimization
 
Cisco Cloudcenter Suite
 
Cisco Connected Analytics Network Deployment
 
Cisco Crosswork Network Automation
 
Cisco Cx Cloud Agent
 
Cisco Cyber Vision
 
Cisco Dna Spaces Connector
 
Cisco Firepower Threat Defense
 
Cisco Mobility Services Engine
 
Cisco Network Dashboard Fabric Controller
 
Cisco Network Insights Data Center
 
Cisco Ucs Central Software
 
Cisco Unified Computing System
 
Cisco Unified Contact Center Management Portal
 
Cisco Video Surveillance Manager
 
Snowsoftware Snow Commander
 
Snowsoftware Vm Access Proxy
 
Bentley Synchro
 
Bentley Synchro 4d
 
Percussion Rhythmyx
 

What versions are vulnerable to CVE-2021-44228?

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-44228

Package Manager Vulnerable Package Versions Fixed In
maven org.apache.logging.log4j:log4j-core <2.15.0 2.15.0
maven org.opencastproject:opencast-common < 9.10 9.10
maven org.opencastproject:opencast-common >= 10.0, < 10.6 10.6
maven de.averbis.textanalysis:pear-archetype = 2.0.0 2.0.1
maven org.powernukkit:powernukkit <= 1.5.2.0 1.5.2.1
maven com.hazelcast.jet:hazelcast-jet >= 4.1, < 4.5.3 4.5.3
maven com.hazelcast:hazelcast >= 5.0, < 5.0.2 5.0.2
maven com.hazelcast:hazelcast < 4.0.5 4.0.5
maven com.hazelcast:hazelcast >= 4.1.1, < 4.1.8 4.1.8
maven com.hazelcast:hazelcast >= 4.2, < 4.2.4 4.2.4