{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.17"}],"component":"log4j:log4j","cve_ids":["CVE-2022-23307"],"ecosystem":"Maven","epss":0.54411,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-f7vh-qwp3-x37m","id":"tcs_01M5N8VE2055G5PAN8B3F3848P","modified_at":"2023-11-08T04:08:17.752586Z","published_at":"2022-01-19T00:01:15Z","references":["https://osv.dev/vulnerability/GHSA-f7vh-qwp3-x37m","https://nvd.nist.gov/vuln/detail/CVE-2022-23307","https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh","https://logging.apache.org/log4j/1.2/index.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-f7vh-qwp3-x37m","url":"https://osv.dev/vulnerability/GHSA-f7vh-qwp3-x37m"}],"summary":"Deserialization of Untrusted Data in Apache Log4j"}