CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName...

CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName...

CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName...

Apache Log4j 1.x Multiple Vulnerabilities (Linux/Unix, Jan 2022) - Version Check

Apache Log4j is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:log4j"; ifdescription...

PT-2022-1423

Name of the Vulnerable Software and Affected Versions Log4j versions 1.x Description The issue is related to the deserialization of untrusted data in the JMSSink component of Log4j 1.x, which can lead to remote code execution when the attacker has write access to the Log4j configuration or access...

PT-2022-7038

Name of the Vulnerable Software and Affected Versions Log4j versions 1.2.x Description The issue is related to the JDBCAppender in Log4j, which accepts an SQL statement as a configuration parameter. This allows attackers to manipulate the SQL by entering crafted strings into input fields or heade...

Moderate: Red Hat Security Advisory: rh-maven36-log4j12 security update

An update for rh-maven36-log4j12 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Apache Log4j allows insecure JNDI lookups

Overview Apache Log4j allows insecure JNDI lookups that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the vulnerable Java application using Log4j. CISA has published Apache Log4j Vulnerability Guidance and provides a Software List. Description Th...