Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Log4Shell: Log4j remote code execution vulnerability

Canonical

on 16 December 2021

This article was last updated 2 years ago.


Last updated on 18th January 2022 to include the latest vulnerability updates.

A high impact vulnerability was discovered in Apache Log4j 2, a widely deployed software component used by a lot of Java applications to facilitate logging. An attacker who can control the log messages or their parameters can cause the application to execute arbitrary code. The initial vulnerability announcement resulted to the discovery a family of vulnerabilities in log4j within December 2021 that were assigned CVE-2021-44228, CVE-2021-45046, CVE-2021-4104, CVE-2021-44832 and CVE-2021-45105.

In Ubuntu, Apache Log4j2 is packaged under the apache-log4j2 source package – this has been patched to include fixes as detailed in USN-5192-1 (released Dec 14) and USN-5197-1 (released Dec 15), USN-5222-1 (released Jan 11), USN-5223-1 (released Jan 12). To apply all available fixes to your Ubuntu system type the following commands in a terminal:

$ sudo ua fix CVE-2021-44228
$ sudo ua fix CVE-2021-45046
$ sudo ua fix CVE-2021-4104
$ sudo ua fix CVE-2021-45105
$ sudo ua fix CVE-2021-44832

Look out for Apache Log4j 2 package usage

The widespread use of the Apache Log4j 2 package, as well as the Java platform’s packaging conventions, have made addressing that vulnerability (by the security industry as a whole) non-trivial. The reason is that this software is not only present in Ubuntu as a packaged component, but separate copies of this software are also often bundled directly in popular applications. In particular, the latter is what makes the task of determining whether a particular application or system is vulnerable quite difficult. Teams have to examine each application individually to find whether applications are vulnerable by “unbundling” them, or by using software bills of materials and manifests. Just updating the Ubuntu packaged version of this software component is likely not sufficient to ensure that all applications which use Apache Log4j 2 are remediated.

Recommendation

We recommend that our users and customers get the latest software security updates from Canonical and verify that any 3rd party Java software they are using is not bundling the log4j packages. To find more information about which Canonical products are affected visit this continuously updated page.

More information about the vulnerability

Talk to us today

Interested in running Ubuntu in your organisation?

Newsletter signup

Get the latest Ubuntu news and updates in your inbox.

By submitting this form, I confirm that I have read and agree to Canonical's Privacy Policy.

Related posts

Zenbleed vulnerability fix for Ubuntu

On 24 July 2023, security researchers from Google’s Information Security Engineering team disclosed a hardware vulnerability affecting AMD’s Zen 2 family of...

Ubuntu Explained: How to ensure security and stability in cloud instances—part 3

Applying updates across a fleet of multiple Ubuntu instances is a balance of security and service uptime. We explore best practices to maximise stability.

Ubuntu Explained: How to ensure security and stability in cloud instances—part 2

You probably know that it is important to apply security updates. You may not be clear how to do that. We are going to explain best practices for applying...