Debian/apache-log4j1.2: high 7.5
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnection
Action: Upgrade apache-log4j1.2 to 1.2.17-11 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.17-11 | - |
Fixed versions
| 1.2.17-11 |
Sources
- osv: DEBIAN-CVE-2021-4104#Debian:13/apache-log4j1.2
- https://security-tracker.debian.org/tracker/CVE-2021-4104
published · modified · JSON