{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0"}],"component":"org.zenframework.z8.dependencies.commons:log4j-1.2.17","cve_ids":["CVE-2021-4104"],"ecosystem":"Maven","epss":0.80599,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fp5r-v3w9-4333","id":"tcs_01M5N8WEKF32R9EQPBNQTY345Q","modified_at":"2023-11-08T04:06:50.238216Z","published_at":"2021-12-14T19:49:31Z","references":["https://osv.dev/vulnerability/GHSA-fp5r-v3w9-4333","https://nvd.nist.gov/vuln/detail/CVE-2021-4104","https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","https://access.redhat.com/security/cve/CVE-2021-4104","https://github.com/apache/logging-log4j2","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202310-16","https://security.gentoo.org/glsa/202312-02","https://security.gentoo.org/glsa/202312-04","https://security.netapp.com/advisory/ntap-20211223-0007","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","http://www.openwall.com/lists/oss-security/2022/01/18/3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fp5r-v3w9-4333#Maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17","url":"https://osv.dev/vulnerability/GHSA-fp5r-v3w9-4333"}],"summary":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data"}