Maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17 CVE-2022-23307: critical 9.8, EPSS 54.41%
Deserialization of Untrusted Data in Apache Log4j
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-f7vh-qwp3-x37m#Maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17
- https://nvd.nist.gov/vuln/detail/CVE-2022-23307
- https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh
- https://logging.apache.org/log4j/1.2/index.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
CVE-2022-23307 · published · modified · JSON