Ubuntu 21.10: 5192-1 Moderate: Apache Log4j 2 Remote Code Exec

ubuntu

December 14, 2021

Apache Log4j 2 could be made to crash or run programs as an administrator if it received a specially crafted input.

Summary

Apache Log4j 2 could be made to crash or run programs as an administrator

if it received a specially crafted input.

Software Description:

- apache-log4j2: Apache Log4j - Logging Framework for Java

Details:

Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run

programs via a special crafted input. An attacker could use this vulnerability

to cause a denial of service or possibly execute arbitrary code.

Topics Covered

security advisory denial of service remote code execution ubuntu administrative access apache log4j

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  liblog4j2-java                  2.15.0-0.21.10.1

Ubuntu 21.04:
  liblog4j2-java                  2.15.0-0.21.04.1

Ubuntu 20.04 LTS:
  liblog4j2-java                  2.15.0-0.20.04.1

Ubuntu 18.04 LTS:
  liblog4j2-java                  2.10.0-2ubuntu0.1

In general, a standard system update will make all the necessary changes.