Remote code injection in Log4j (through pax-logging-log4j2)

概要

参考情報

• ops4j/org.ops4j.pax.logging security advisory · WEB
• GitHub Advisory GHSA-jfh8-c2jp-5v3q · ADVISORY
• ops4j/org.ops4j.pax.logging · PACKAGE

org.ops4j.pax.logging:pax-logging-log4j2 のその他の脆弱性

• CVE-2021-44832中 6.6Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution…
• CVE-2021-45105中 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referent…
• CVE-2021-45046緊急 9.0悪用確認済み（CISA KEV）It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could …
• CVE-2021-44228緊急 10.0悪用確認済み（CISA KEV）Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log mess…