Impacted Docker Official Images and Mitigation Details for Log4j 2 CVE

may get input from. So you probably will want to upgrade all code using vulnerable versions. > CVE-2021-45046 > > As an update to > [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), the fix made in version 2.15.0 was > incomplete. Additional issues have been identified and are tracked with > [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) and > [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). > For a more complete fix to this vulnerability, we recommended that you update to 2.17.0 where possible. ### Scan images on Docker Hub Docker Hub security scans triggered after 1700 UTC 13 December 2021 are now correctly identifying the Log4j 2 CVEs. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md). ## Docker Official Images impacted by Log4j 2 CVE _Last updated December 2021_ A number of [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of Log4j 2 CVE-2021-44228. The following table lists Docker Official Images that may contained the vulnerable versions of Log4j 2. We updated Log4j 2 in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites. | Repository | Patched version | Additional documentation | |:------------------------|:-----------------------|:-----------------------| | [couchbase](https://hub.docker.com/_/couchbase) | 7.0.3 | [Couchbase blog](https://blog.couchbase.com/what-to-know-about-the-log4j-vulnerability-cve-2021-44228/) | | [Elasticsearch](https://hub.docker.com/_/elasticsearch) | 6.8.22, 7.16.2 | [Elasticsearch announcement](https://www.elastic.co/blog/new-elasticsearch-and-logstash-releases-upgrade-apache-log4j2) | | [Flink](https://hub.docker.com/_/flink) | 1.11.6, 1.12.7, 1.13.5, 1.14.2 | [Flink advice on Log4j CVE](https://flink.apache.org/2021/12/10/log4j-cve.html) | | [Geonetwork](https://hub.docker.com/_/geonetwork) | 3.10.10 | [Geonetwork GitHub discussion](https://github.com/geonetwork/core-geonetwork/issues/6076) | | [lightstreamer](https://hub.docker.com/_/lightstreamer) | Awaiting info | Awaiting info | | [logstash](https://hub.docker.com/_/logstash) | 6.8.22, 7.16.2 | [Elasticsearch announcement](https://www.elastic.co/blog/new-elasticsearch-and-logstash-releases-upgrade-apache-log4j2) | | [neo4j](https://hub.docker.com/_/neo4j) | 4.4.2 | [Neo4j announcement](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j/48856) | | [solr](https://hub.docker.com/_/solr) | 8.11.1 | [Solr security news](https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228) | | [sonarqube](https://hub.docker.com/_/sonarqube) | 8.9.5, 9.2.2 | [SonarQube announcement](https://community.sonarsource.com/t/sonarqube-sonarcloud-and-the-log4j-vulnerability/54721) | | [storm](https://hub.docker.com/_/storm) | Awaiting info | Awaiting info | > [!NOTE] > > Although [xwiki](https://hub.docker.com/_/xwiki) images may be detected as vulnerable by some scanners, the authors believe the images are not vulnerable by Log4j 2 CVE as the API jars do not contain the vulnerability. > The [Nuxeo](https://hub.docker.com/_/nuxeo) > image is deprecated and will not be updated.

This section discusses the impact of the Log4j 2 vulnerability (CVE-2021-44228) on Docker Official Images. It mentions that Docker Hub security scans after 1700 UTC 13 December 2021 correctly identify the Log4j 2 CVEs, recommending users to trigger scans by pushing new images. A table lists Docker Official Images (e.g., couchbase, Elasticsearch, Flink) that may contain vulnerable versions of Log4j 2, along with their patched versions and additional documentation links. It notes that while XWiki images might be flagged as vulnerable, the authors believe they are not, and that the Nuxeo image is deprecated and will not be updated.