Skip to content
OpenAdvisories
High USN-5223-2 1 CVE

apache-log4j1.2 vulnerability

Published Feb 8, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-5223-1 fixed a vulnerability in Apache Log4j 1.2. This update
provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Apache Log4j 1.2 was vulnerable to deserialization of
untrusted data if the configuration file was editable. An attacker could use
this vulnerability to cause a DoS or possibly execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS apache-log4j1.2 1.2.17-7ubuntu1+esm1

Vulnerabilities 1

  • High 7.5
    CVE-2021-4104 Public exploit EPSS 81%

    Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2021-4104