GHSA-xxfh-x98p-j8fr
Remote code injection in Log4j (through pax-logging-log4j2)
At a glance
- Published
- Updated
Description
### Impact Remote Code Execution. ### Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11. ### Workarounds Set system property `-Dlog4j2.formatMsgNoLookups=true` ### References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
Affected packages
| Package | Versions |
|---|---|
| Maven · org.ops4j.pax.logging:pax-logging-log4j2 | introduced 2.0.0, fixed 2.0.11 |
| Maven · org.ops4j.pax.logging:pax-logging-log4j2 | introduced 0, fixed 1.11.10 |
References
- https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr WEB
- https://github.com/advisories/GHSA-jfh8-c2jp-5v3q ADVISORY
- https://github.com/ops4j/org.ops4j.pax.logging PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |