SUSE-SU-2020:0054-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...

SUSE-SU-2020:0053-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...

acegisecurity:acegi-security (>=0.7.0, <=0.9.0), acegisecurity:acegi-security-cas (>=0.7.0, <=0.9.0) +42556 more potentially affected by CVE-2019-17571 via log4j:log4j (>=1.2.4, <=1.2.17)

log4j:log4j MAVEN version =1.2.4, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =g11-3.2.4, =1.3, =1.4 and more Source cves: CVE-2019-17571 Source advisory: OSV:GHSA-2QRG-X229-3V8Q...

org.zenframework.z8.dependencies:z8-dependencies-commons (2.0) potentially affected by CVE-2019-17571 via org.zenframework.z8.dependencies.commons:log4j-1.2.17 (2.0)

org.zenframework.z8.dependencies.commons:log4j-1.2.17 MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.zenframework.z8.dependencies.commons:log4j-1.2.17 and may be impacted: - org.zenframework.z8.dependencies:z8-dependencies-common...

acegisecurity:acegi-security (>=0.7.0, <=0.9.0), acegisecurity:acegi-security-cas (>=0.7.0, <=0.9.0) +42556 more potentially affected by CVE-2019-17571 via log4j:log4j (>=1.2.4, <=1.2.17)

log4j:log4j MAVEN version =1.2.4, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =g11-3.2.4, =1.3, =1.4 and more Source cves: CVE-2019-17571 Source advisory: GHSA-2QRG-X229-3V8Q...

GHSA-2QRG-X229-3V8Q Deserialization of Untrusted Data in Log4j

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up ...

Deserialization of Untrusted Data in Log4j

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up ...

org.zenframework.z8.dependencies:z8-dependencies-commons (2.0) potentially affected by CVE-2019-17571 via org.zenframework.z8.dependencies.commons:log4j-1.2.17 (2.0)

org.zenframework.z8.dependencies.commons:log4j-1.2.17 MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.zenframework.z8.dependencies.commons:log4j-1.2.17 and may be impacted: - org.zenframework.z8.dependencies:z8-dependencies-common...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.4.8), ai.api.libai.web:libai-web-servlet (>=1.4.6, <=1.4.8) +3488 more potentially affected by CVE-2017-5645 via org.apache.logging.log4j:log4j-core (>=2.0, <=2.8.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =1.4.6, =1.4.6, =1.1.0, =1.0.0, =0.0.1, =0.0.2, =0.1.0, =5.7.1 and more Source cves: CVE-2017-5645 Source advisory: OSV:GHSA-FXPH-Q3J8-MV87...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.4.8), ai.api.libai.web:libai-web-servlet (>=1.4.6, <=1.4.8) +3488 more potentially affected by CVE-2017-5645 via org.apache.logging.log4j:log4j-core (>=2.0, <=2.8.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =1.4.6, =1.4.6, =1.1.0, =1.0.0, =0.0.1, =0.0.2, =0.1.0, =5.7.1 and more Source cves: CVE-2017-5645 Source advisory: GHSA-FXPH-Q3J8-MV87...

ch.cern.sparkmeasure:spark-measure_2.11 (0.11), com.foreks:vertx-config-launcher (>=0.9.0, <=0.9.4) +6 more potentially affected by CVE-2017-5645 via org.apache.logging.log4j:log4j (>=2.3, <=2.8)

org.apache.logging.log4j:log4j MAVEN version =2.3, =0.9.0, =0.1.0, =0.1.7, =0.2.4, =0.2.4, =1.0.0, =1.2.0 Source cves: CVE-2017-5645 Source advisory: OSV:GHSA-FXPH-Q3J8-MV87...

ch.cern.sparkmeasure:spark-measure_2.11 (0.11), com.foreks:vertx-config-launcher (>=0.9.0, <=0.9.4) +6 more potentially affected by CVE-2017-5645 via org.apache.logging.log4j:log4j (>=2.3, <=2.8)

org.apache.logging.log4j:log4j MAVEN version =2.3, =0.9.0, =0.1.0, =0.1.7, =0.2.4, =0.2.4, =1.0.0, =1.2.0 Source cves: CVE-2017-5645 Source advisory: GHSA-FXPH-Q3J8-MV87...

Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

GHSA-FXPH-Q3J8-MV87 Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

Apache ActiveMQ Log4j Remote Code Execution Vulnerability

Apache ActiveMQ is the Apache Software Foundation under an open source message-driven middleware software . A remote code execution vulnerability exists in Apache ActiveMQ Log4j, which can be exploited by an attacker to execute code...

Arbitrary Code Execution

log4j-core is vulnerable to arbitrary code execution. Deserialization of untrusted data in TcpSocketServer and UdpSocketServer when listening for log data allows an attacker to execute arbitrary code via a malicious deserialization gadget...

Apache Log4j Untrusted Data Deserialization Vulnerability

Apache Log4j is the United States Apache Apache Software Foundation of a Java-based open source logging tools. A security vulnerability exists in Apache Log4j version 1.2. Attackers can exploit the vulnerability to execute code...

CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...

CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...

DEBIAN-CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...