Debian LTS: DLA-2842-1: apache-log4j2 security update

Advisories

-------------------------------------------------------------------------
Debian LTS Advisory DLA-2842-1                [email protected]
https://www.debian.org/lts/security/                      Markus Koschany
December 12, 2021                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : apache-log4j2
Version        : 2.7-2+deb9u1
CVE ID         : CVE-2021-44228
Debian Bug     : 1001478

Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features
used in configuration, log messages, and parameters do not protect
against attacker controlled LDAP and other JNDI related endpoints. An
attacker who can control log messages or log message parameters can
execute arbitrary code loaded from LDAP servers when message lookup
substitution is enabled.

For Debian 9 stretch, this problem has been fixed in version
2.7-2+deb9u1.

We recommend that you upgrade your apache-log4j2 packages.

For the detailed security status of apache-log4j2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apache-log4j2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-2842-1: apache-log4j2 security update

December 12, 2021
Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and ot...

Summary


Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features
used in configuration, log messages, and parameters do not protect
against attacker controlled LDAP and other JNDI related endpoints. An
attacker who can control log messages or log message parameters can
execute arbitrary code loaded from LDAP servers when message lookup
substitution is enabled.

For Debian 9 stretch, this problem has been fixed in version
2.7-2+deb9u1.

We recommend that you upgrade your apache-log4j2 packages.

For the detailed security status of apache-log4j2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apache-log4j2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Severity
Package : apache-log4j2
Version : 2.7-2+deb9u1
CVE ID : CVE-2021-44228
Debian Bug : 1001478

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.