Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia 8: 2022-0002 Moderate: Mitigation Implemented for Log4j RCE Risk

mageia
Calendar Grey January 3, 2022
Dist Mageia Esm H88
Mageia 2022-0003 improves OpenSSL libraries to fix critical security flaws related to SSL/TLS connections vulnerabilities affecting data integrity.
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configurati...

Summary

Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol

References

- https://bugs.mageia.org/show_bug.cgi?id=29827

- https://www.openwall.com/lists/oss-security/2021/12/28/1

-

- https://www.cve.org/CVERecord?id=CVE-2021-44832

Topics%20covered

Topics Covered

security advisory moderate remote code execution Mageia Log4j

Resolution

SRPMS

- 8/core/log4j-2.17.1-1.mga8

Publication date: 03 Jan 2022
URL: https://advisories.mageia.org/MGASA-2022-0002.html
Type: security
CVE: CVE-2021-44832

Topics%20covered

Topics Covered

security advisory moderate remote code execution Mageia Log4j

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here