Impact of December 2021 Apache Log4j Vulnerabilities on Oracle cloud environments (CVE-2021-44228, CVE-2021-45046) (Doc ID 2830129.1)

Last updated on FEBRUARY 07, 2022

Applies to:

Purpose

On December 10th, Oracle released Security Alert CVE-2021-44228 in response to the disclosure of a new vulnerability affecting Apache Log4j prior to version 2.15.

Subsequently, the Apache Software Foundation released Apache version 2.16 which addresses an additional vulnerability (CVE-2021-45046). Mitigation instructions from Apache for these issues also evolved over time.

The Oracle cloud operations and security teams continue to evaluate all information related to CVE-2021-45046 and CVE-2021-44228.

Scope

This document provides information about the remedial status of Oracle cloud environments in response to vulnerabilities CVE-2021-44228 AND CVE-2021-45046 (e.g., Oracle Applications, Oracle NetSuite, Oracle Cloud Infrastructure, Oracle Industry Clouds, etc.).

Note that remediation activities in these cloud environments have been ongoing since the initial release of the Alert, and some customers may have already received notifications of mandatory maintenance (if the maintenance resulted in a noticeable impact such as service interruption).

For information about Oracle on-premises products, customers should refer to “Impact of December 2021 Apache Log4j Vulnerabilities on Oracle on-premises products (CVE-2021-44228, CVE-2021-45046)” (MOS Note ID 2830143.1).

If you do not find information about a given product in this MOS Note, you should look in the other MOS Note.

Details