Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fed1b378 by Salvatore Bonaccorso at 2021-12-13T20:19:04+01:00
Add CVE-2021-4104/apache-log4j1.2
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,12 @@
CVE-2021-44833 (The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions
for the c ...)
NOT-FOR-US: CLI for Amazon AWS OpenSearch
+CVE-2021-4104 [Deserialization of untrusted data in JMSAppender]
+ - apache-log4j1.2 <unfixed>
+ [bullseye] - apache-log4j1.2 <no-dsa> (Minor issue; JMSAppender not
configured to be used by default)
+ [buster] - apache-log4j1.2 <no-dsa> (Minor issue; JMSAppender not
configured to be used by default)
+ NOTE: https://www.openwall.com/lists/oss-security/2021/12/13/1
+ NOTE:
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
+ NOTE: Issue for Log4j 1.2 when specifically configured to use
JMSAppender (not the default)
CVE-2021-4103
RESERVED
CVE-2021-44832
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fed1b378c598edd5e0f807bde6586a6f8e4b5040
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fed1b378c598edd5e0f807bde6586a6f8e4b5040
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
