Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

log4j:log4j

6 known vulnerabilities (2 critical, 4 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 critical, 4 high
Registry
Maven Central

Advisories 6

  • Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

    Affected: from 1.0.4, fixed in 2.0.

  • A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

    Affected: through 1.2.17.

  • CVE-2022-23305Critical 9.8

    SQL injection in JDBC Appender in Apache Log4j V1

    Affected: through 1.2.17.

  • Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

    Affected: through 1.2.17.

  • Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    Affected: from 1.2.0, through 1.2.17.

  • CVE-2019-17571Critical 9.8

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely…

    Affected: from 1.2, through 1.2.17.