Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Affected: Maven: log4j:log4j, Maven: org.zenframework.z8.dependencies.commons:log4j-1.2.17

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.

Users are advised to migrate to `org.apache.logging.log4j:log4j-core`.

Security update for log4j

openssl: OCSP Status Request extension unbounded memory growth openssl: ECDSA P-256 timing attack key recovery SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS log4j: Socket receiver deserialization vulnerability tomcat: Incorrect handling of pipelined requests when send file was used tomcat: Calls to application listeners did not use the appropriate facade object tomcat: Security constrained bypass in error page mechanism tomcat: Vary header not added by CORS filter leading to cache poisoning log4j: deserialization of untrusted data in SocketServer

Security update for log4j

Affected: Ubuntu:Pro:14.04:LTS: apache-log4j1.2, Ubuntu:Pro:16.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j1.2

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen.