Apache, the most commonly used web server for Linux systems, has released its latest secure version of Log4j (2.17.1), which patches a critical remote code execution (RCE) vulnerability, tracked as CVE-2021-44832. This is the fifth identified Log4j vulnerability in less than a month, and the original flaw (tracked as CVE-2021-44228) was weaponized by threat actors, leading to thousands of Java applications being left vulnerable, affecting millions of systems worldwide. CVE-2021-44832 however, stems from a lack of additional controls on JDNI (Java Naming and Directory Interface) access in log4j, and the issue description seen by BleepingComputer states, “JDBC Appender should use JndiManager when accessing JNDI. JNDI access should be controlled via a system property.” The lack of control means that if an attacker acquires the necessary permissions to modify the logging configuration file, they could maliciously configure using a JDBC Appender with a JNDI URI data source that has the capability to execute arbitrary or malicious code from remote. To mitigate this flaw, the Ankura CTIX urges any Log4j users to immediately update to release 2.17.1 (for Java 8).