MGASA-2022-0002 Updated log4j packages fix security vulnerability

Apache Log4j2 is vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed b...

openSUSE 15 Security Update : log4j (openSUSE-SU-2022:0002-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0002-1 advisory. - Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE...

Debian DLA-2870-1 : apache-log4j2 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2870 advisory. - Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration...

openSUSE 15 Security Update : log4j (openSUSE-SU-2021:4208-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:4208-1 advisory. - Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE...

Debian DLA-2852-1 : apache-log4j2 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2852 advisory. Several security vulnerabilities were found in Apache Log4j2, a Logging Framework for Java, which could lead to a denial of service or information disclosure...

Debian: Security Advisory (DLA-2870-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2870-1] apache-log4j2 security update

Debian LTS Advisory DLA-2870-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany December 29, 2021 https://wiki.debian.org/LTS Package : apache-log4j2 Version : 2.12.4-0+deb9u1 CVE ID : CVE-2021-44832 Debian Bug : 1002813 Apache Log4j2, a Java Logging Framework, is...

Exploit for Improper Input Validation in Apache Log4J

Log4j 2.17.0 RCE – CVE-2021-44832 Reproducibility 1. Laun...

DLA-2870-1 apache-log4j2 - security update

Bulletin has no description...

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

UBUNTU-CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

Remote code execution

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

com.esri.geoevent.sdk:geoevent-sdk (10.9.1), hu.blackbelt.osgi.filestore:features (>=1.2.1, <=1.3.0) +50 more potentially affected by CVE-2021-44832 via org.ops4j.pax.logging:pax-logging-log4j2 (>=2.0.0, <=2.0.13)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =2.0.0, =1.2.1, =1.2.1, =1.0.12, =1.0.12, =2.14.2, =1.2.5, =2.18.0, =3.11.1, =3.10.0, =3.5.0, =4.3.0.rc1, =4.3.0.rc1, =4.3.5 - org.apache.karaf.features:enterprise-legacy 4.3.0.rc1 and more Source cves: CVE-2021-44832 Source advisory:...

com.esri.geoevent.sdk:geoevent-sdk (>=10.6.0, <=10.7.0), com.savoirtech.aetos:aetos (4.1.1.0) +80 more potentially affected by CVE-2021-44832 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.8.2, <=1.9.1)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.8.2, =10.6.0, =0.2.0, =7.3.0, =7.3.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.3.0 - de.mhus.app:mhus-web 7.2.0 - de.mhus.app:web-api 7.2.0 - de.mhus.app:web-core 7.2.0 - de.mhus.app:web-jetty 7.2.0 - de.mhus.app:web-util 7.2.0 and more...

com.esri.geoevent.sdk:geoevent-sdk (10.9.0), com.influxdb:influxdb-karaf (>=2.2.0, <=5.0.0) +102 more potentially affected by CVE-2021-44832 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.11.3, <=1.11.12)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.11.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =4.2.0.1, =4.2.1 - de.mhus.app.reactive:reactive-dev 7.9.0 - de.mhus.app.reactive:reactive-karaf 7.9.0 - de.mhus.app.vault:vault-api 7.7.0 - de.mhus.app.vault:vault-core 7.7.0 -...

ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0), com.esri.geoevent.sdk:geoevent-sdk (>=10.7.1, <=10.8.1) +118 more potentially affected by CVE-2021-44832 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.10.0, <=1.10.8)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.10.0, =3.3.0, =10.7.1, =2.0.1, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.611, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.24.01 and more Source cves: CVE-2021-44832 Source advisory: MEND:CVE-2021-44832...

CVE-2021-44832 Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...