USN-4495-1: Apache Log4j vulnerability
Published Sep 15, 2020
·Updated
It was discovered that Apache Log4j does not properly deserialize untrusted data. An attacker could possibly use this issue to remotely execute arbitrary code. (CVE-2019-17571)
Affected Software
1 affected component
Apache Log4j
Event History
May 29, 2026
Advisory Published
via Ubuntu·06:52 PM
Data Sourced
via Ubuntu·06:52 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this Apache Log4j vulnerability?
The vulnerability ID for this Apache Log4j vulnerability is CVE-2019-17571.
2
What is the severity of the CVE-2019-17571 vulnerability?
The severity of the CVE-2019-17571 vulnerability has not been provided.
3
How does the Apache Log4j vulnerability work?
The Apache Log4j vulnerability allows an attacker to remotely execute arbitrary code by exploiting a deserialization flaw.
4
Which versions of liblog4j1.2-java are affected by this vulnerability?
The version affected by this vulnerability is 1.2.17-8+deb10u1build0.18.04.1.
5
How can I fix the Apache Log4j vulnerability in Ubuntu 18.04?
To fix the Apache Log4j vulnerability in Ubuntu 18.04, update the liblog4j1.2-java package to version 1.2.17-8+deb10u1build0.18.04.1 or later.