Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14eGZoLXg5OHAtajhmcs0atA

Remote code injection in Log4j (through pax-logging-log4j2)

Impact

Remote Code Execution.

Patches

Users of pax-logging 1.11.9 should update to 1.11.10.
Users of pax-logging 2.0.10 should update to 2.0.11.

Workarounds

Set system property -Dlog4j2.formatMsgNoLookups=true

References

https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

Permalink: https://github.com/advisories/GHSA-xxfh-x98p-j8fr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eGZoLXg5OHAtajhmcs0atA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-xxfh-x98p-j8fr
References:

• https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr
• https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
• https://github.com/advisories/GHSA-xxfh-x98p-j8fr

Repository: https://github.com/ops4j/org.ops4j.pax.logging
Blast Radius: 0.0

Affected Packages