The original report out of China in late February said 2%, with the highest-risk age group at 15% for over 80. But it turns out that that number was derived from just dividing deaths into total cases, in the middle of the epidemic. Obviously some of the newly infected people hadn't had time to die, and so this makes the fatality late look lower than it is. If you do the same calculation for China now, it's 4%.
Apparently this is a common thing to do, even if it is mathematically questionable. In 2003, when SARS 1 was just starting, the WHO estimated its fatality rate at 4%, because they were doing the math in the middle of the epidemic. The actual CFR for SARS is about 10%. (source for 4% estimate in comments)
Another way epidemiologists do the calculation of fatality rate is to divide deaths into total resolved cases (dead plus recovered). The problem with this is that some people die a few days after diagnosis, but nobody is recovered that quickly. So this method overstates the fatality rate, especially early in the progress of the epidemic. Using this method, China is at 4.5%.
However, we know that there are many cases that are not being counted as official, so the actual fatality rate is almost certainly lower than 4%.
South Korea has been testing more extensively than any other country. They have done a bit over 300,000 tests, 2.9% of which have come back positive. The age group that contains the highest number of cases is 20-29. So that gives a clue that South Korea is actually seeing the hidden cases that other countries are missing. Their CFR is 1% if you use the method that undercounts, and 5.5% if you use the method that overcounts. Just by eyeballing the graph of how the "high" number changed for China over time, I'm guessing about 2.5%. Which means that the bad math may have come up with the correct answer, just by chance.