[SECURITY] [DLA 2842-1] apache-log4j2 security update

Debian LTS Advisory DLA-2842-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
December 12, 2021 https://wiki.debian.org/LTS

Package : apache-log4j2
Version : 2.7-2+deb9u1
CVE ID : CVE-2021-44228
Debian Bug : 1001478

Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features
used in configuration, log messages, and parameters do not protect
against attacker controlled LDAP and other JNDI related endpoints. An
attacker who can control log messages or log message parameters can
execute arbitrary code loaded from LDAP servers when message lookup
substitution is enabled.

For Debian 9 stretch, this problem has been fixed in version
2.7-2+deb9u1.

We recommend that you upgrade your apache-log4j2 packages.

For the detailed security status of apache-log4j2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apache-log4j2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part