MGASA-2021-0572 - Updated log4j packages fix security vulnerability

Publication date: 20 Dec 2021
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-45105

Updated log4j packages fix security vulnerability:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from
uncontrolled recursion from self-referential lookups. This allows an
attacker with control over Thread Context Map data to cause a denial
of service when a crafted string is interpreted (CVE-2021-45105).


- 8/core/log4j-2.17.0-1.mga8