Debian/apache-log4j2: critical 9
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC)
Action: Upgrade apache-log4j2 to 2.16.0-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.16.0-1 | - |
Fixed versions
| 2.16.0-1 |
Sources
- osv: DEBIAN-CVE-2021-45046#Debian:14/apache-log4j2
- https://security-tracker.debian.org/tracker/CVE-2021-45046
published · modified · JSON