5.8 KiB
| description | keywords | title | toc_min | toc_max |
|---|---|---|---|---|
| Docker security announcements | Docker, CVEs, security, notice, Log4J 2, Log4Shell, announcements | Docker security announcements | 1 | 2 |
Log4j 2 CVE-2021-44228
The Log4j 2 CVE-2021-44228{: target="blank" rel="noopener" class=""} vulnerability in Log4j 2, a very common Java logging library, allows remote code execution, often from a context that is easily available to an attacker. For example, it was found in Minecraft servers which allowed the commands to be typed into chat logs as these were then sent to the logger. This makes it a very serious vulnerability, as the logging library is used so widely and it may be simple to exploit. Many open source maintainers are working hard with fixes and updates to the software ecosystem.
The vulnerable versions of Log4j 2 are versions 2.0 to version 2.14.1 inclusive. The first fixed version is 2.15.0. We strongly encourage you to update to the latest version if you can. If you are using a version before 2.0, you are also not vulnerable.
You may not be vulnerable if you are using these versions, as your configuration may already mitigate this (see the Mitigations section below), or the things you log may not include any user input. This may be difficult to validate however without understanding all the code paths that may log in detail, and where they may get input from. So you probably will want to upgrade all code using vulnerable versions.
CVE-2021-45046
As an update to CVE-2021-44228{: target="blank" rel="noopener" class=""}, the fix made in version 2.15.0 was incomplete. Additional issues have been identified and are tracked with CVE-2021-45046{: target="blank" rel="noopener" class=""} and CVE-2021-45105{: target="blank" rel="noopener" class=""}. For a more complete fix to this vulnerability, we recommended that you update to 2.17.0 where possible. {: .important}
Scan images using the docker scan command
The configuration for the docker scan command previously shipped in Docker
Desktop versions 4.3.0 and earlier unfortunately do not detect this
vulnerability on scans. You must update your Docker Desktop installation to
4.3.1 or higher to fix this issue. For detailed instructions, see Scan images for Log4j2 CVE.
Scan images on Docker Hub
Docker Hub security scans triggered after 1700 UTC 13 December 2021 are now correctly identifying the Log4j2 CVE. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing the image to Docker Hub to view the status of Log4j2 CVE in the vulnerability report. For detailed instructions, see Scan images on Docker Hub.
Docker Official Images impacted by Log4j 2 CVE
Important
We will be updating this section with the latest information. We recommend that you revisit this section to view the list of affected images and update images to the patched version as soon as possible to remediate the issue. {: .important}
A number of Docker Official Images contain the vulnerable versions of Log4j 2 CVE-2021-44228. The following table lists Docker Official Images that may contain the vulnerable versions of Log4j 2. We are working on updating Log4j 2 in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites.
| Repository | Patched version | Additional documentation |
|---|---|---|
| couchbase | 7.0.3 | Couchbase blog |
| Elasticsearch | 7.16.1, 6.8.21 | Elasticsearch security announcement |
| Flink | 1.11.6, 1.12.7, 1.13.5, 1.14.2 | Flink advice on Log4j CVE |
| Geonetwork | 3.10.10 | Geonetwork GitHub discussion |
| lightstreamer | Awaiting info | Awaiting info |
| logstash | 7.16.1 | Awaiting info |
| neo4j | 4.4.2 | Neo4j announcement |
| solr | 8.11.1 | Solr security news |
| sonarqube | 8.9.5, 9.2.2 | SonarQube announcement |
| storm | Awaiting info | Awaiting info |
Note
Although xwiki{: target="blank" rel="noopener" class=""} images may be detected as vulnerable by some scanners, the authors believe the images are not vulnerable by Log4j 2 CVE as the API jars do not contain the vulnerability. The Nuxeo{: target="blank" rel="noopener" class=""} image is deprecated and will not be updated.