CVE:CVE-2021-44832
CNNVD:CNNVD-202112-2743
Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。
Apache Log4j2 2.0-beta7 到 2.17.0版本存在注入漏洞，该漏洞源于软件中对于JDBC Appender 和JNDI 缺少有效的防护与过滤。有权修改日志配置文件的攻击者可以构建恶意配置 将 JDBC Appender 与引用 JNDI URI 的数据源一起使用，该 JNDI URI 可以执行远程代码。
solution:Upgrade apache log4j to a higher version than 2.3.2,2.12.4,2.17.1,2.0,2.0:beta7,2.0:beta8,2.0:beta9,2.0:rc1,2.0:rc2,and avoid the version [2.0.1,2.3.2),[2.4,2.12.4),[2.13.0,2.17.1),2.0,2.0:beta7,2.0:beta8,2.0:beta9,2.0:rc1,2.0:rc2; Upgrade oracle communications_diameter_signaling_router to a higher version than 8.5.1.0,8.5.1.0,and avoid the version [8.0.0.0,8.5.1.0],[8.3.0.0,8.5.1.0]; Upgrade oracle communications_interactive_session_recorder to a higher version than 6.3,6.4,and avoid the version 6.3,6.4; Upgrade oracle primavera_gateway to a higher version than 17.12.11,18.8.13,19.12.12,20.12.7,21.12.0,and avoid the version [17.12.0,17.12.11],[18.8.0,18.8.13],[19.12.0,19.12.12],[20.12.0,20.12.7],21.12.0; Upgrade oracle primavera_p6_enterprise_project_portfolio_management to a higher version than 19.12.18.0,20.12.12.0,21.12.0.0,19.12.18.0,and avoid the version [19.12.0,19.12.18.0],[20.12.0.0,20.12.12.0],21.12.0.0,[19.12.0.0,19.12.18.0]; Upgrade oracle primavera_unifier to a higher version than 18.8,19.12,20.12,21.12,and avoid the version 18.8,19.12,20.12,21.12; Upgrade oracle retail_assortment_planning to a higher version than 16.0.3,and avoid the version 16.0.3; Upgrade oracle retail_fiscal_management to a higher version than 14.2,and avoid the version 14.2; Upgrade oracle siebel_ui_framework to a higher version than 21.12,21.12,and avoid the version 21.12,(,21.12]; Upgrade oracle weblogic_server to a higher version than 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0,and avoid the version 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0; Upgrade cisco cloudcenter to a higher version than 4.10.0.16,and avoid the version 4.10.0.16; Upgrade fedoraproject fedora to a higher version than 34,35,and avoid the version 34,35; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade oracle communications_brm_-_elastic_charging_engine to a higher version than 12.0.0.4.6,12.0.0.5.0,and avoid the version (,12.0.0.4.6),12.0.0.5.0; Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.4.4,12.0.0.5.0,and avoid the version (,12.0.0.4.4),12.0.0.5.0; Upgrade oracle flexcube_private_banking to a higher version than 12.1.0,and avoid the version 12.1.0; Upgrade oracle health_sciences_data_management_workbench to a higher version than 2.5.2.1,3.0.0.0,3.1.0.3,and avoid the version 2.5.2.1,3.0.0.0,3.1.0.3; Upgrade oracle policy_automation to a higher version than 12.2.24,and avoid the version [12.2.0,12.2.24]; Upgrade oracle policy_automation_for_mobile_devices to a higher version than 12.2.24,and avoid the version [12.2.0,12.2.24]; Upgrade oracle product_lifecycle_analytics to a higher version than 3.6.1,and avoid the version 3.6.1; Upgrade oracle retail_order_broker to a higher version than 18.0,19.1,and avoid the version 18.0,19.1; Upgrade oracle retail_xstore_point_of_service to a higher version than 17.0.4,18.0.3,19.0.2,20.0.1,21.0.1,and avoid the version 17.0.4,18.0.3,19.0.2,20.0.1,21.0.1