Latest apache log4j Vulnerabilities

● CVE-2023-26464

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-craft...

Apache Log4j>=1.0.4<2.0

● CVE-2022-23307

A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized. Note this is the same as <a href="https://access.redhat.com/security/cve...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 193 more

● CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 194 more

● CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 196 more

● CVE-2021-44832

Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appe...

redhat/log4j<2.17.1

redhat/log4j<2.12.4

redhat/log4j<2.3.2

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

Apache Log4j>=2.0.1<2.3.2

and 58 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-45046

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Apache Log4j2

debian/apache-log4j2<=2.15.0-1<=2.15.0-1~deb10u1<=2.15.0-1~deb11u1

maven/org.apache.logging.log4j:log4j-core<2.12.2

maven/org.apache.logging.log4j:log4j-core>=2.13.0<2.16.0

Apache Log4j>=2.0.1<2.12.2

Apache Log4j>=2.13.0<2.16.0

and 194 more

● CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

redhat/log4j<0:1.2.14-6.5.el6_10

redhat/log4j<0:1.2.17-17.el7_4

redhat/log4j<0:1.2.17-16.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 219 more

● CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

debian/apache-log4j1.2

debian/apache-log4j2

debian/apache-log4j2<=2.13.3-1<=2.7-2<=2.11.1-2

Apple Xcode<13.3

Apache Log4j>=2.0.1<2.3.1

Apache Log4j>=2.4.0<2.12.2

and 429 more

● CVE-2021-42340

Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket connections. By sending a specially-crafted request using OutOfMemoryError, a remote attacker could exploi...

redhat/pki-servlet-engine<1:9.0.50-1.el9

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8

and 47 more

● CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, ...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 55 more

● CVE-2020-9493

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

<2.1.0

Apache Log4j>=1.2<2.0

<1.2.18.1

IBM QRadar SIEM<=7.5 - 7.5.0 UP7

● CVE-2021-20026

Apache Log4j<2.2.0

Apache Log4j=2.2.0

Apache Log4j=2.2.0-r10

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2020-13936

Apache Velocity could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw. By modifying the Velocity templates, an attacker could exploit this vulnerabilit...

ubuntu/velocity<1.7-5ubuntu0.18.04.1~

ubuntu/velocity<1.7-5+

ubuntu/velocity<1.7-4ubuntu0.1~

debian/velocity

redhat/velocity<2.3

redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea

and 89 more

● CVE-2020-1945

Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sending a specially-crafted request, an attacke...

Apache Ant>=1.1<=1.9.14

Apache Ant>=1.10.0<=1.10.7

Canonical Ubuntu Linux=19.10

Fedoraproject Fedora=31

Fedoraproject Fedora=32

openSUSE Leap=15.2

and 128 more

● CVE-2020-9488

Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this vulnerability to launch a ma...

debian/apache-log4j2

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

and 110 more

● CVE-2019-17571

A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined w...

maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17=2.0

maven/log4j:log4j>=1.2<=1.2.17

debian/apache-log4j1.2<=1.2.17-5<=1.2.17-7<=1.2.17-8

redhat/log4j<0:1.2.14-6.7.el6_10

redhat/log4j<0:1.2.17-16.el7_4

redhat/log4j<0:1.2.14-19.patch_01.ep5.el5

and 45 more

● CVE-2019-2904

Oracle ADF Faces Deserialization of Untrusted Data Remote Code Execution Vulnerability

Oracle Application Testing Suite=12.5.0.3

Oracle Application Testing Suite=13.1.0.1

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Banking Enterprise Collections=2.7.0

Oracle Banking Enterprise Collections=2.8.0

and 43 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

Latest apache log4j Vulnerabilities

Company

Resources

Contact