Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:4208-1

Опубликовано: 30 дек. 2021
Источник: suse-cvrf

Описание

Security update for log4j

This update for log4j fixes the following issues:

  • CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127)

Список пакетов

openSUSE Leap 15.3
log4j-2.17.0-4.16.1
log4j-javadoc-2.17.0-4.16.1
log4j-jcl-2.17.0-4.16.1
log4j-slf4j-2.17.0-4.16.1

Ссылки

Описание

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Затронутые продукты
openSUSE Leap 15.3:log4j-2.17.0-4.16.1
openSUSE Leap 15.3:log4j-javadoc-2.17.0-4.16.1
openSUSE Leap 15.3:log4j-jcl-2.17.0-4.16.1
openSUSE Leap 15.3:log4j-slf4j-2.17.0-4.16.1
Ссылки