Medium DLA-2852-1 2 CVEs

apache-log4j2 - security update

Published Dec 26, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	apache-log4j2	2.12.3-0+deb9u1

Vulnerabilities 2

Medium 5.9

CVE-2021-45105 Public exploit EPSS 100%

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 18, 2021
Low 3.7

CVE-2020-9488 Public exploit

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.…

Apache Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Apr 27, 2020