Amazon Linux AMI : log4j-cve-2021-44228-hotpatch (ALAS-2022-1580)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1580 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. In order to mimic the Linux capabilities of the target process, Amazon Linu...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. In order to mimic the Linux capabilities of the target process, Amazon Linu...

PT-2022-2393 · Apache · Log4J

Name of the Vulnerable Software and Affected Versions: Apache Log4j versions prior to log4j-cve-2021-44228-hotpatch-1.1-13 Description: The issue is related to insecure privilege management in the Log4j Java logging program. It allows an attacker to escalate their privileges. Recommendations: For...

Apache Log4j security vulnerability

Apache Log4j is a Java-based open source logging tool from the Apache Foundation. Amazon Linux log4j-cve-2021-44228-hotpatch version 1.1-12 previously had a security vulnerability that stemmed from the Apache Log4j hotpatch package prior to log4j-cve-2021-44228-hotpatch-1.1-12 not mimicking the...

Security Bulletin: IBM Informix Dynamic Server is vulnerable to denial of service (CVE-2021-45105) and remote code execution (CVE-2021-45046) due to Apache Log4j

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Informix Dynamic Server for IBM Informix HQ. IBM Informix Dynamic Server is vulnerable to denial of service CVE-2021-45105 and remote code execution CVE-2021-45046 due to Apache Log4j. The fix is included in Apac...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to arbitrary code exection due to Apache Log4j (CVE-2022-23307)

Summary IBM Tivoli Netcool Impact which includes the ActiveMQ package is vulnerable to arbitrary code exection due to Apache Log4j CVE-2022-23307 . This has been addressed by updating ActiveMQ to version 5.16.4 which removes Apache Log4j v1 from ActiveMQ. Vulnerability Details CVEID:CVE-2022-2330...

Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Log4j vulnerability (CVE-2022-23305)

Summary Apache Log4j v1 is shipped within the ActiveMQ package of IBM Tivoli Netcool Impact. This has been resolved by updating ActiveMQ to version 5.16.4 which removes log4j from ActiveMQ. Vulnerability Details CVEID: CVE-2022-23305 DESCRIPTION: Apache Log4j is vulnerable to SQL injection. A...

Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Log4j vulnerability (CVE-2022-23302)

Summary Apache Log4j v1 is shipped within the ActiveMQ package of IBM Tivoli Netcool Impact. This has been resolved by updating ActiveMQ to version 5.16.4 which removes log4j from ActiveMQ. Vulnerability Details CVEID: CVE-2022-23302 DESCRIPTION: Apache Log4j could allow a remote authenticated...

Security Bulletin: IBM Informix Dynamic Server in Cloud Pak for Data is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary Apache Log4j library CVE-2021-45105, CVE-2021-45046 is used to provide logging functionality for IBM Informix Dynamic Server in Cloud Pak for Data CP4D. The fix includes Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of...

Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to arbitrary code execution due to Apache Log4j (CVE-2022-23307, CVE-2022-23302) and SQL injection due to Apache Log4j (CVE-2022-23305)

Summary IBM App Connect Enterprise & IBM Integration Bus are vulnerable to arbitrary code execution due to Apache Log4j CVE-2022-23307, CVE-2022-23302 and SQL injection due to Apache Log4j CVE-2022-23305. This affects the logging infrastructure in IBM App Connect Enterprise and IBM Integration Bu...

Security Bulletin: IBM Urbancode Deploy impacted by Apache Log4j SQL Injection vulnerability. (CVE-2022-23305)

Summary When added to the logging configuration, the Log4j JDBCAppender may not be properly encoding content sent to an external SQL database. This is a non-default configuration. The fix removes this component. Vulnerability Details CVEID: CVE-2022-23305 DESCRIPTION: Apache Log4j is vulnerable t...

Security Bulletin: Watson Knowledge Catalog InstaScan is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary Watson Knowledge Catalog InstaScan uses Apache Log4j as part of its logging infrastructure. Hence it is vulnerable to denial of service CVE-2021-45105 and arbitrary code execution CVE-2021-45046. The fix includes Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION...

Security Bulletin: IBM Security Access Manager for Enterprise Single Sign-On may be vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104)

Summary Vulnerability in Apache Log4j CVE-2021-4104 may affect IBM Security Access Manager for Enterprise Single Sign-On. Although no known vulnerability impact has been proven, it is strongly recommended to apply the fix that upgrades log4j from version 1.x to version 2.1.17. Vulnerability Detai...

Security Bulletin: IBM Db2 Web Query for i is vulnerable to denial of service in Apache Commons Compress (CVE-2021-36090), arbitrary code execution in Apache Log4j (CVE-2021-44832), and cross-site scripting in TIBCO WebFOCUS (CVE-2021-35493)

Summary There are vulnerabilities in Apache Commons Compress CVE-2021-36090, Apache Log4j CVE-2021-44832, and TIBCO WebFOCUS CVE-2021-35493 as described in the vulnerability details section. Apache Commons Compress is used by Db2 Web Query for zipping and unzipping objects, such as import and...

Apache Log4j 2.0.x Multiple Vulnerabilities (Web Application URL Parameter, Log4Shell) - Active Check

Apache Log4j is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: MAS Monitor 8.4, 8.5, and 8.6 log4j

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details...

Security Bulletin: CVE-2021-44228 log4j affects MAS Monitor 8.4, 8.5 and 8.6

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details CVEID...

Apache Log4j 2.0.x Multiple Vulnerabilities (HTTP Web Dirs, Log4Shell) - Active Check

Apache Log4j is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-45105, CVE-2021-44832)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...