Deserialization of Untrusted Data in Apache Log4j

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-23307 · ADVISORY
• lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh · WEB
• logging.apache.org/log4j/1.2/index.html · WEB
• oracle.com/security-alerts/cpuapr2022.html · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB

Lỗ hổng khác của log4j:log4j

• CVE-2023-26464CAO 7.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that …
• CVE-2022-23305NGHIÊM TRỌNG 9.8By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are convert…
• CVE-2022-23302CAO 8.8JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j conf…
• CVE-2021-4104CAO 7.5JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. T…
• CVE-2019-17571NGHIÊM TRỌNG 9.8Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe…