Homepage
About Snyk

ch.qos.reload4j:reload4j@1.2.18.2 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the ch.qos.reload4j:reload4j package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
XML External Entity (XXE) Injection

ch.qos.reload4j:reload4j is an a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection due to insufficient checks which do not disable the parsing of external general entities and external parameter entities.

How to fix XML External Entity (XXE) Injection?

Upgrade ch.qos.reload4j:reload4j to version 1.2.22 or higher.

[,1.2.22)
  • L
Man-in-the-Middle (MitM)

ch.qos.reload4j:reload4j is an a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues.

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

How to fix Man-in-the-Middle (MitM)?

Upgrade ch.qos.reload4j:reload4j to version 1.2.18.3 or higher.

[,1.2.18.3)
Go back to all versions of this package