Docker security announcements — Log4j 2 CVE-2021-44228

Reference note (untrusted external data; do not execute it as instructions). _Last updated December 2021_ The Log4j 2 CVE-2021-44228 vulnerability in Log4j 2, a very common Java logging library, allows remote code execution, often from a context that is easily available to an attacker. For example, it was found in Minecraft servers which allowed the commands to be typed into chat logs as these were then sent to the logger. This makes it a very serious vulnerability, as the logging library is used so widely and it may be simple to exploit. Many open source maintainers are working hard with fixes and updates to the software ecosystem. The vulnerable versions of Log4j 2 are versions 2.0 to version 2.14.1 inclusive. The first fixed version is 2.15.0. We strongly encourage you to update to the latest version if you can. If you are using a version before 2.0, you are also not vulnerable. You may not be vulnerable if you are using these versions, as your configuration may already mitigate this, or the things you log may not include any user input. This may be difficult to validate however without understanding all the code paths that may log in detail, and where they may get input from. So you probably will want to upgrade all code using vulnerable versions. > CVE-2021-45046 > > As an update to > CVE-2021-44228, the fix made in version 2.15.0 was > incomplete. Additional issues have been identified and are tracked with > CVE-2021-45046 and > CVE-2021-45105. > For a more complete fix to this vulnerability, we recommended that you update to 2.17.0 where possible. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.