Exploited in the wild · Apache Log4j 2 · CVSS 10.0 · published 10 December 2021
Log4Shell: CVE-2021-44228
Log4j 2 looked up JNDI addresses written into log messages, so an attacker who could get a string logged could make the server load and run remote code. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 1end-of-life systems without a free fix
- 8fixed or not affected
Log4Shell on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not affected | Red Hat security data |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | Not packaged | the distribution does not ship it |
| Ubuntu 16.04 | Fixed only in Ubuntu Pro | 2.4-2ubuntu0.1~esm1 |
| Ubuntu 18.04 | Fixed | 2.10.0-2ubuntu0.1 |
| Ubuntu 20.04 | Fixed | 2.15.0-0.20.04.1 |
| Debian 10 | Fixed | 2.15.0-1~deb10u1, DSA-5020-1 |
| Debian 11 | Fixed | 2.15.0-1~deb11u1, DSA-5020-1 |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
The Log4j versions we track
| Version | CVE-2021-44228 |
|---|---|
| Log4j 1.2.17 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Score 10.0 (Critical), published 10 December 2021. Listed in the CISA catalogue of known exploited vulnerabilities on 10 December 2021. Read the NVD entry
Affected upstream versions of Apache Log4j 2
- log4j from 2.0.1 before 2.3.1
- log4j from 2.4.0 before 2.12.2
- log4j from 2.13.0 before 2.15.0
- log4j version 2.0
What you can do
Keep Apache Log4j 2, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.