Debian LTS: DLA-2842-1: apache-log4j2 security update
Summary
Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features
used in configuration, log messages, and parameters do not protect
against attacker controlled LDAP and other JNDI related endpoints. An
attacker who can control log messages or log message parameters can
execute arbitrary code loaded from LDAP servers when message lookup
substitution is enabled.
For Debian 9 stretch, this problem has been fixed in version
2.7-2+deb9u1.
We recommend that you upgrade your apache-log4j2 packages.
For the detailed security status of apache-log4j2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/apache-log4j2
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS