Advisory ROSA-SA-2021-1909

Software: log4j 1.2.17
OS: Cobalt 7.9

CVE-ID: CVE-2019-17571
CVE-Crit: CRITICAL
CVE-DESC: Log4j 1.2 includes a SocketServer class vulnerable to unreliable data deserialization, which can be used to remotely execute arbitrary code in conjunction with a deserialization gadget while listening to unreliable network traffic for log data. This affects Log4j versions 1.2 through 1.2.17.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2020-9488
CVE-Crit: LOW
CVE-DESC: Incorrect certificate validation with host mismatch in Apache Log4j SMTP application. This could allow the SMTPS connection to be intercepted with a man-in-the-middle attack, which could leak any log messages sent through this application.
CVE-STATUS: Default
CVE-REV: Default