Deserialization of Untrusted Data in Apache Log4j

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-23307 · ADVISORY
• lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh · WEB
• logging.apache.org/log4j/1.2/index.html · WEB
• oracle.com/security-alerts/cpuapr2022.html · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB

log4j:log4j のその他の脆弱性

• CVE-2023-26464高 7.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that …
• CVE-2022-23305緊急 9.8By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are convert…
• CVE-2022-23302高 8.8JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j conf…
• CVE-2021-4104高 7.5JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. T…
• CVE-2019-17571緊急 9.8Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe…