Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:0051-1

Опубликовано: 14 янв. 2020
Источник: suse-cvrf

Описание

Security update for log4j

This update for log4j fixes the following issues:

  • CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.1
log4j-1.2.17-lp151.5.3.1
log4j-javadoc-1.2.17-lp151.5.3.1
log4j-manual-1.2.17-lp151.5.3.1
log4j-mini-1.2.17-lp151.5.3.1

Ссылки

Описание

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Затронутые продукты
openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1
openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1
openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1
openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1
Ссылки