Deserialization of Untrusted Data in Apache Log4j

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-23307 · ADVISORY
• lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh · WEB
• logging.apache.org/log4j/1.2/index.html · WEB
• oracle.com/security-alerts/cpuapr2022.html · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB

log4j:log4j의 다른 취약점

• CVE-2023-26464높음 7.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that …
• CVE-2022-23305심각 9.8By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are convert…
• CVE-2022-23302높음 8.8JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j conf…
• CVE-2021-4104높음 7.5JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. T…
• CVE-2019-17571심각 9.8Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe…