Remote code injection in Log4j (through pax-logging-log4j2)

Description

References

• ops4j/org.ops4j.pax.logging security advisory · WEB
• GitHub Advisory GHSA-jfh8-c2jp-5v3q · ADVISORY
• ops4j/org.ops4j.pax.logging · PACKAGE

Autres vulnérabilités de org.ops4j.pax.logging:pax-logging-log4j2

• CVE-2021-44832MOYENNE 6.6Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution…
• CVE-2021-45105MOYENNE 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referent…
• CVE-2021-45046CRITIQUE 9.0EXPLOITED (CISA KEV)It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could …
• CVE-2021-44228CRITIQUE 10.0EXPLOITED (CISA KEV)Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log mess…