Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:4118-1

Опубликовано: 20 дек. 2021
Источник: suse-cvrf

Описание

Security update for log4j

This update for log4j fixes the following issues:

  • Update to 2.17.0
  • CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation. (bsc#1193887, bsc#1193888)

Список пакетов

openSUSE Leap 15.3
log4j-2.17.0-4.13.1
log4j-javadoc-2.17.0-4.13.1
log4j-jcl-2.17.0-4.13.1
log4j-slf4j-2.17.0-4.13.1

Ссылки

Описание

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Затронутые продукты
openSUSE Leap 15.3:log4j-2.17.0-4.13.1
openSUSE Leap 15.3:log4j-javadoc-2.17.0-4.13.1
openSUSE Leap 15.3:log4j-jcl-2.17.0-4.13.1
openSUSE Leap 15.3:log4j-slf4j-2.17.0-4.13.1
Ссылки