A critical remote code execution vulnerability (CVE-2021-44228, CVSS 10.0) exists in Apache log4j, allowing attackers to execute arbitrary code via crafted log messages. The article lists an extensive range of affected products and vendors, including Cisco, VMware, IBM, Red Hat, and many others across operating systems, appliances, and applications. Mitigation guidance is noted as available, but specific fixed version numbers and workarounds are not detailed in the provided text.
[WID-SEC-2022-0351] Apache log4j: Schwachstelle ermöglicht Codeausführung CVSS Base Score 10.0 (kritisch) CVSS Temporal Score 9.3 (kritisch) Remoteangriff ja Datum 09.12.2021 Stand UPDATE 08.07.2026 Mitigation ja Betroffene Systeme Betriebssystem Appliance CISCO Appliance Hardware Appliance Juniper Appliance Linux Native Hypervisor NetApp Appliance Sonstiges UNIX Windows Produktbeschreibung Apache log4j ist ein Framework zum Loggen von Anwendungsmeldungen in Java. Produkte UPDATE 05.11.2025 Dell ECS UPDATE 23.02.2025 Red Hat JBoss Enterprise Application Platform <7.3.12 Red Hat JBoss Enterprise Application Platform <7.1.9 UPDATE 30.08.2022 Kyocera Printer UPDATE 12.07.2022 IBM Content Manager UPDATE 26.04.2022 Avaya one-X Avaya Aura Experience Portal UPDATE 03.02.2022 IBM Informix Dynamic Server UPDATE 26.01.2022 ASC NEO UPDATE 18.01.2022 Unify OpenScape Deployment Service (DLS) Unify OpenScape 4000 Unify OpenScape Xpert UPDATE 17.01.2022 IBM Rational Software Architect UPDATE 12.01.2022 SmartBear SoapUI UPDATE 10.01.2022 IBM Operational Decision Manager UPDATE 09.01.2022 EMC Data Domain OS EMC Avamar EMC Data Domain Dell Data Protection Advisor UPDATE 22.12.2021 IBM Informix HCL Domino IBM Tivoli Netcool/OMNIbus UPDATE 20.12.2021 VMware Cloud Foundation Cisco Application Policy Infrastructure Controller Cisco Unified Communications Manager (CUCM) Session Management Edition NetApp ActiveIQ Unified Manager NetApp Data ONTAP Tools for VMware vSphere VMware Cloud Director Object Storage Extension VMware SD-WAN VMware vRealize Operations Cloud Proxy UPDATE 19.12.2021 Citrix Systems Virtual Apps and Desktops IBM Tivoli Monitoring HCL Commerce IBM Spectrum Scale IBM Business Automation Workflow UPDATE 16.12.2021 Avaya Aura Media Server Siemens SPPA-T3000 Cisco Unified Contact Center Express (UCCX) Unify OpenScape Voice Unify OpenScape Contact Center TIBCO Spotfire Hitachi Storage Palo Alto Networks PAN-OS Avaya Aura Session Manager Avaya Aura Application Enablement Services Avaya Aura Device Services Avaya Aura System Manager Avaya Session Border Controller Avaya Breeze Platform Avaya Oceana Unify OpenScape Mediaserver Cisco Unified Intelligence Center IBM InfoSphere Information Server Atlassian Bitbucket Cisco Nexus Insights Cisco Network Services Orchestrator Cisco Unified Computing System (UCS) Central Software TIBCO Spotfire Statistics Services TIBCO Managed File Transfer Avaya Analytics Avaya Aura Web Gateway UPDATE 15.12.2021 IBM DB2 SUSE Linux IBM Spectrum Protect SAP Software IBM Security Guardium UPDATE 14.12.2021 Wibu-Systems CodeMeter Ubuntu Linux IBM SPSS IBM MQ 9.1 IBM MQ 9.2 QNAP NAS UPDATE 13.12.2021 Cisco Video Surveillance Operations Manager Cisco Finesse Cisco Emergency Responder Red Hat Enterprise Linux Cisco Unity Connection Juniper Junos Space Cisco Firepower Dashboard Siemens SIMATIC WinCC <V7.4 SP1 Unify OpenScape UC Application <V10.3.10 UPDATE 12.12.2021 Cisco Unified Contact Center Enterprise Debian Linux Red Hat OpenShift VMware NSX Data Center for vSphere Amazon Linux 2 IBM WebSphere Application Server Apache Struts Cisco Unified Intelligent Contact Management Enterprise VMware Carbon Black Cloud Workload Cisco Identity Services Engine (ISE) Cisco WebEx Meetings Server Red Hat JBoss Enterprise Application Platform Red Hat OpenStack Splunk Splunk Enterprise Open Source Elasticsearch VMware vCenter Server Cisco Integrated Management Controller Atlassian Jira Red Hat JBoss A-MQ Atlassian Confluence Cisco Unified Computing System (UCS) Director Cisco SD-WAN vManage F-Secure Policy Manager Symantec Endpoint Protection Manager RSA SecurID Authentication Manager Apache Kafka Apache Solr Cisco Nexus Dashboard Cisco Unified Communications Manager (CUCM) Cloud Cisco WebEx Cloud-Connected UC VMware Horizon VMware Identity Manager VMware Workspace One Access Connector VMware Workspace One Access VMware vRealize Log Insight VMware vRealize Operations VMware vRealize Suite Lifecycle Manager VMware Tanzu Spring Boot SOS GmbH JobScheduler Open Source LogStash Atlassian Bamboo Atlassian Crucible Atlassian Fisheye Red Hat Process Automation Manager 09.12.2021 Apache log4j <2.16.0 Angriff Angriff Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben