jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

openSUSE Security Update : log4j (openSUSE-2020-51)

This update for log4j fixes the following issues : - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and packag...

OPENSUSE-SU-2020:0051-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646. This update was imported from the SUSE:SLE-15:Update update project...

Security update for log4j (important)

openSUSE Security Update: Security update for log4j Announcement ID: openSUSE-SU-2020:0051-1 Rating: important References: 1159646 Cross-References: CVE-2019-17571 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for log4j fix...

DLA-2065-1 apache-log4j1.2 - security update

Bulletin has no description...

SUSE-SU-2020:14267-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...

SUSE-SU-2020:0054-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...

SUSE-SU-2020:0053-1 Security update for log4j

This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...

GHSA-2QRG-X229-3V8Q Deserialization of Untrusted Data in Log4j

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up ...

Deserialization of Untrusted Data in Log4j

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up ...

GHSA-FXPH-Q3J8-MV87 Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

Apache ActiveMQ Log4j Remote Code Execution Vulnerability

Apache ActiveMQ is the Apache Software Foundation under an open source message-driven middleware software . A remote code execution vulnerability exists in Apache ActiveMQ Log4j, which can be exploited by an attacker to execute code...

Arbitrary Code Execution

log4j-core is vulnerable to arbitrary code execution. Deserialization of untrusted data in TcpSocketServer and UdpSocketServer when listening for log data allows an attacker to execute arbitrary code via a malicious deserialization gadget...

Apache Log4j Untrusted Data Deserialization Vulnerability

Apache Log4j is the United States Apache Apache Software Foundation of a Java-based open source logging tools. A security vulnerability exists in Apache Log4j version 1.2. Attackers can exploit the vulnerability to execute code...

DEBIAN-CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...

CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...