GHSA-xxfh-x98p-j8fr json
Remote code injection in Log4j (through pax-logging-log4j2)
published 2021-12-10 4 y ago modified 2024-12-02 23 mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Impact Remote Code Execution.
### Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.
### Workarounds Set system property `-Dlog4j2.formatMsgNoLookups=true`
### References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
Patch / fix
- maven org.ops4j.pax.logging:pax-logging-log4j2 1.11.10, 2.0.11
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=2.0.0, <2.0.11 <1.11.10 |
2.0.11 1.11.10 |
References
Sources
- GitHub Advisory GHSA-xxfh-x98p-j8fr
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.