log4j:log4j@1.2.17 vulnerabilities
-
latest version
1.2.17
-
first published
21 years ago
-
latest version published
12 years ago
-
licenses detected
- [0,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the log4j:log4j package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Denial of Service (DoS). When using the This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x NOTE: This vulnerability only affects products that are no longer supported by the maintainer. How to fix Denial of Service (DoS)? There is no fixed version for |
[1.0.4,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Note: this issue only affects Log4j 1.x when specifically configured to use Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. How to fix Deserialization of Untrusted Data? There is no fixed version for |
[0,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to SQL Injection. By design, the Note: this issue only affects Log4j 1.x when specifically configured to use the Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. Beginning in version 2.0-beta8, the How to fix SQL Injection? There is no fixed version for |
[0,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. How to fix Deserialization of Untrusted Data? There is no fixed version for |
[0,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Arbitrary Code Execution. In order to leverage this vulnerability the following conditions must be met:
If these conditions are met, log4j 1.x allows a How to fix Arbitrary Code Execution? There is no fixed version for |
[0,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. How to fix Deserialization of Untrusted Data? There is no fixed version for |
[0,)
|
log4j:log4j is a 1.x branch of the Apache Log4j project. Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. How to fix Man-in-the-Middle (MitM)? There is no fixed version for |
[0,)
|