{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0"}],"component":"org.zenframework.z8.dependencies.commons:log4j-1.2.17","cve_ids":["CVE-2022-23307"],"ecosystem":"Maven","epss":0.54411,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-f7vh-qwp3-x37m","id":"tcs_01M5N8VE6ZQRW278E6EGA56JS9","modified_at":"2023-11-08T04:08:17.752586Z","published_at":"2022-01-19T00:01:15Z","references":["https://osv.dev/vulnerability/GHSA-f7vh-qwp3-x37m","https://nvd.nist.gov/vuln/detail/CVE-2022-23307","https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh","https://logging.apache.org/log4j/1.2/index.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-f7vh-qwp3-x37m#Maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17","url":"https://osv.dev/vulnerability/GHSA-f7vh-qwp3-x37m"}],"summary":"Deserialization of Untrusted Data in Apache Log4j"}