Log4j 2 Vulnerability (CVE-2021-44228) Details and Mitigation

- [sliverpeas](https://hub.docker.com/_/sliverpeas) - [solr](https://hub.docker.com/_/solr) - [xwiki](https://hub.docker.com/_/xwiki) We have updated Apache Commons Text in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites. ## Log4j 2 CVE-2021-44228 _Last updated December 2021_ The [Log4j 2 CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) vulnerability in Log4j 2, a very common Java logging library, allows remote code execution, often from a context that is easily available to an attacker. For example, it was found in Minecraft servers which allowed the commands to be typed into chat logs as these were then sent to the logger. This makes it a very serious vulnerability, as the logging library is used so widely and it may be simple to exploit. Many open source maintainers are working hard with fixes and updates to the software ecosystem. The vulnerable versions of Log4j 2 are versions 2.0 to version 2.14.1 inclusive. The first fixed version is 2.15.0. We strongly encourage you to update to the [latest version](https://logging.apache.org/log4j/2.x/download.html) if you can. If you are using a version before 2.0, you are also not vulnerable. You may not be vulnerable if you are using these versions, as your configuration may already mitigate this, or the things you log may not include any user input. This may be difficult to validate however without understanding all the code paths that may log in detail, and where they may get input from. So you probably will want to upgrade all code using vulnerable versions. > CVE-2021-45046 > > As an update to > [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), the fix made in version 2.15.0 was > incomplete. Additional issues have been identified and are tracked with > [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) and > [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). > For a more complete fix to this vulnerability, we recommended that you update to 2.17.0 where possible. ### Scan images on Docker Hub Docker Hub security scans triggered after 1700 UTC 13 December 2021 are now correctly identifying the Log4j 2 CVEs. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md).

This section provides details on the Log4j 2 vulnerability (CVE-2021-44228), which allows remote code execution. It specifies the vulnerable versions (2.0 to 2.14.1) and recommends updating to the latest version (2.15.0 or later). It also mentions that some configurations might mitigate the vulnerability, but upgrading is still advised. Notes the incomplete fix in version 2.15.0 (CVE-2021-45046 and CVE-2021-45105) and recommends updating to 2.17.0 for a more complete fix. It further informs that Docker Hub security scans after 1700 UTC 13 December 2021 correctly identify the Log4j 2 CVEs and recommends triggering scans by pushing new images.