Apache Log4j — библиотека журналирования (логирования) Java-программ
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|
Показывать по
Количество 144
CVE-2021-44832
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
openSUSE-SU-2021:1613-1
Security update for logback
openSUSE-SU-2021:1612-1
Security update for log4j12
openSUSE-SU-2021:1605-1
Security update for log4j
ELSA-2021-5206
ELSA-2021-5206: log4j security update (MODERATE)
openSUSE-SU-2021:4118-1
Security update for log4j
CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-45105
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and ...
BDU:2021-06325
Уязвимость библиотеки журналирования Java-программ Log4j, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю вызвать отказ в обслуживании
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2021-44832 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. | CVSS3: 6.6 | 98% Критический | почти 5 лет назад |
 | openSUSE-SU-2021:1613-1 Security update for logback | 100% Критический | почти 5 лет назад | |
| openSUSE-SU-2021:1612-1 Security update for log4j12 | 81% Высокий | почти 5 лет назад | |
| openSUSE-SU-2021:1605-1 Security update for log4j | 100% Критический | почти 5 лет назад | |
| ELSA-2021-5206 ELSA-2021-5206: log4j security update (MODERATE) | 81% Высокий | почти 5 лет назад | |
| openSUSE-SU-2021:4118-1 Security update for log4j | 100% Критический | почти 5 лет назад | |
 | CVE-2021-45105 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1. | CVSS3: 5.9 | 100% Критический | почти 5 лет назад |
 | CVE-2021-45105 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1. | CVSS3: 5.9 | 100% Критический | почти 5 лет назад |
| CVE-2021-45105 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and ... | CVSS3: 5.9 | 100% Критический | почти 5 лет назад |
 | BDU:2021-06325 Уязвимость библиотеки журналирования Java-программ Log4j, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 100% Критический | почти 5 лет назад |
Уязвимостей на страницу