Maven/log4j:log4j CVE-2021-4104: high 7.5, EPSS 80.60%
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | - | 1.2.17 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-fp5r-v3w9-4333
- https://nvd.nist.gov/vuln/detail/CVE-2021-4104
- https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
- https://access.redhat.com/security/cve/CVE-2021-4104
- https://github.com/apache/logging-log4j2
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
- https://security.gentoo.org/glsa/202209-02
- https://security.gentoo.org/glsa/202310-16
- https://security.gentoo.org/glsa/202312-02
- https://security.gentoo.org/glsa/202312-04
- https://security.netapp.com/advisory/ntap-20211223-0007
- https://www.cve.org/CVERecord?id=CVE-2021-44228
- https://www.kb.cert.org/vuls/id/930724
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2022/01/18/3
CVE-2021-4104 · published · modified · JSON