Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-5998-1
HistoryApr 05, 2023 - 12:00 a.m.

Apache Log4j vulnerabilities

2023-04-0500:00:00
ubuntu.com
52

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.794 High

EPSS

Percentile

98.2%

JSON

Releases

  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 ESM
  • Ubuntu 16.04 ESM

Packages

  • apache-log4j1.2 - Java-based open-source logging tool

Details

It was discovered that the SocketServer component of Apache Log4j 1.2
incorrectly handled deserialization. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2019-17571)

It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-23302)

It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL
statements. A remote attacker could possibly use this issue to perform an SQL
injection attack and alter the database. This issue was only fixed in Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)

It was discovered that the Chainsaw component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2022-23307)

OSVersionArchitecturePackageVersionFilename
Ubuntu20.04noarchliblog4j1.2-java< 1.2.17-9ubuntu0.2UNKNOWN
Ubuntu20.04noarchliblog4j1.2-java-doc< 1.2.17-9ubuntu0.2UNKNOWN
Ubuntu18.04noarchliblog4j1.2-java< 1.2.17-8+deb10u1ubuntu0.2UNKNOWN
Ubuntu18.04noarchliblog4j1.2-java-doc< 1.2.17-8+deb10u1ubuntu0.2UNKNOWN
Ubuntu16.04noarchliblog4j1.2-java< 1.2.17-7ubuntu1+esm1UNKNOWN
Ubuntu16.04noarchliblog4j1.2-java< 1.2.17-7ubuntu1UNKNOWN
Ubuntu16.04noarchliblog4j1.2-java-doc< 1.2.17-7ubuntu1UNKNOWN

Related

openvas 23
osv 10
ibm 41
redhat 32
nessus 45
amazon 2
suse 5
oraclelinux 3
centos 1
debian 4
rocky 1
atlassian 9
almalinux 1
cloudlinux 2
mageia 1
gentoo 1
veracode 4
f5 2
debiancve 1
github 1
checkpoint_advisories 1
ubuntu 1
cve 2
prion 1
ubuntucve 2
symantec 1
cnvd 1
redhatcve 1
openvas
openvas
Ubuntu: Security Advisory (USN-5998-1)
2023-04-06 00:00:00
openSUSE: Security Advisory for log4j12 (openSUSE-SU-2022:0226-1)
2022-02-08 00:00:00
CentOS: Security Advisory for log4j (CESA-2022:0442)
2022-02-09 00:00:00
osv
osv
apache-log4j1.2 vulnerabilities
2023-04-05 21:26:34
Important: parfait:0.5 security update
2022-01-26 14:27:19
Important: parfait:0.5 security update
2022-01-26 14:27:19
ibm
ibm
Security Bulletin: Log4j vulnerabilities affect IBM Netezza Analytics for NPS
2022-06-03 14:32:29
Security Bulletin: Due to use of Apache Log4j, IBM Netcool/OMNIbus Probe DSL Factory Framework is vulnerable to arbitrary code execution (CVE-2022-23302, CVE-2022-23307) and SQL injection (CVE-2022-23305)
2022-03-16 02:35:57
Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to arbitrary code execution due to Apache Log4j (CVE-2022-23307, CVE-2022-23302) and SQL injection due to Apache Log4j (CVE-2022-23305)
2022-04-01 12:22:27
redhat
redhat
(RHSA-2022:0439) Important: rh-maven36-log4j12 security update
2022-02-03 18:49:50
(RHSA-2022:0442) Important: log4j security update
2022-02-07 09:41:50
(RHSA-2022:0507) Important: Red Hat JBoss Data Virtualization 6.4.8.SP2 security update
2022-02-10 17:22:10
nessus
nessus
CentOS 7 : log4j (CESA-2022:0442)
2022-02-08 00:00:00
RHEL 6 / 7 : log4j (RHSA-2022:0442)
2022-02-08 00:00:00
RHEL 7 : rh-maven36-log4j12 (RHSA-2022:0439)
2022-02-04 00:00:00
amazon
amazon
Important: log4j
2023-03-30 22:50:00
Important: log4j
2022-02-15 22:54:00
suse
suse
Security update for log4j12 (important)
2022-01-28 00:00:00
Security update for log4j (important)
2022-01-27 00:00:00
Security update for kafka (important)
2022-02-16 00:00:00
oraclelinux
oraclelinux
log4j security update
2022-02-08 00:00:00
log4j security update
2022-05-23 00:00:00
parfait:0.5 security update
2022-01-27 00:00:00
centos
centos
log4j security update
2022-02-07 16:47:44
debian
debian
[SECURITY] [DLA 2905-1] apache-log4j1.2 security update
2022-01-31 14:24:44
[SECURITY] [DLA 2065-1] apache-log4j1.2 security update
2020-01-12 22:27:19
[SECURITY] [DSA 4686-1] apache-log4j1.2 security update
2020-05-15 22:17:02
rocky
rocky
parfait:0.5 security update
2022-01-26 14:27:19
atlassian
atlassian
Confluence: Multiple vulnerabilities in log4j < 1.2.7-atlassian-16
2022-06-01 07:36:00
Update Log4j to 1.2.17-atlassian-16 to fix CVE-2022-23305, CVE-2022-23307, CVE-2020-9493, CVE-2022-23302
2022-07-04 12:01:21
Update Log4j to 1.2.17-atlassian-16 to fix CVE-2022-23305, CVE-2022-23307, CVE-2020-9493, CVE-2022-23302
2022-07-04 12:01:19
almalinux
almalinux
Important: parfait:0.5 security update
2022-01-26 14:27:19
cloudlinux
cloudlinux
Fix of CVE: CVE-2022-23307, CVE-2022-23302
2022-02-10 13:49:32
Fixed CVE-2019-17571 in log4j
2022-06-21 20:23:31
mageia
mageia
Updated davmail packages fix security vulnerability
2023-04-15 22:03:44
gentoo
gentoo
Apache Log4j: Multiple Vulnerabilities
2024-02-18 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-12-23 04:57:47
Remote Code Execution (RCE)
2022-01-19 04:24:50
Deserialisation Of Untrusted Object
2022-01-19 08:50:05
f5
f5
K61529042 : Log4j vulnerability CVE-2019-17571
2020-04-08 00:00:00
K34002344 : Overview of Log4j vulnerabilities (2021 and 2022)
2022-02-01 00:00:00
debiancve
debiancve
CVE-2019-17571
2019-12-20 17:15:00
github
github
Deserialization of Untrusted Data in Log4j
2020-01-06 18:43:49
checkpoint_advisories
checkpoint_advisories
Apache Log4j Remote Code Execution (CVE-2019-17571)
2020-03-01 00:00:00
ubuntu
ubuntu
Apache Log4j vulnerability
2020-09-15 00:00:00
cve
cve
CVE-2019-17571
2019-12-20 17:15:00
CVE-2022-23305
2022-01-18 16:15:00
prion
prion
Deserialization of untrusted data
2019-12-20 17:15:00
ubuntucve
ubuntucve
CVE-2019-17571
2019-12-20 00:00:00
CVE-2022-23305
2022-01-18 00:00:00
symantec
symantec
Apache Log4j CVE-2019-17571 Deserialization Remote Code Execution Vulnerability
2019-12-18 00:00:00
cnvd
cnvd
Apache log4j Chainsaw deserialization code execution vulnerability
2022-01-20 00:00:00
redhatcve
redhatcve
CVE-2022-23305
2022-01-18 16:16:17

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.794 High

EPSS

Percentile

98.2%

JSON
Related for USN-5998-1
openvas23osv10ibm41redhat32nessus45amazon2suse5oraclelinux3centos1debian4rocky1atlassian9almalinux1cloudlinux2mageia1gentoo1veracode4f52debiancve1github1checkpoint_advisories1ubuntu1cve2prion1ubuntucve2symantec1cnvd1redhatcve1