Skip to content
OpenAdvisories
Medium ELSA-2021-5206 1 CVE

Moderate: log4j security update (Oracle Linux 7)

Published Dec 21, 2021 · Updated Dec 21, 2021

Ecosystem: Oracle Linux

Summary

[0:1.2.17-17]
- Fix remote code execution vulnerability
- Resolves: CVE-2021-4104

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 log4j 0:1.2.17-17.el7_4
Oracle Linux · 7 log4j-javadoc 0:1.2.17-17.el7_4
Oracle Linux · 7 log4j-manual 0:1.2.17-17.el7_4

Vulnerabilities 1

  • High 7.5
    CVE-2021-4104 Public exploit EPSS 81%

    Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven