DeutschShown in its original language — a full translation is planned for a future version.
Apache log4j: Mehrere Schwachstellen
view advisory published 2022-01-18
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen oder einen SQL-Injection durchzuführen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23307US | high8.8 | — | ||
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exi… | ||||
| CVE-2022-23305US | critical9.8 | Exploit | ||
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message conv… | ||||
| CVE-2022-23302US | high8.8 | — | ||
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration refere… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2022-0290 vom 2022-01-27external
- Oracle Linux Security Advisory ELSA-2022-0442 vom 2022-02-08external
- Eintrag in der OSS-Mailinglist vom 2022-01-18external
- Eintrag in der OSS-Mailinglist vom 2022-01-18external
- Eintrag in der OSS-Mailinglist vom 2022-01-18external
- Red Hat Security Advisory RHSA-2022:0289 vom 2022-01-26external
- Red Hat Security Advisory RHSA-2022:0290 vom 2022-01-26external
- Red Hat Security Advisory RHSA-2022:0291 vom 2022-01-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan