Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Ubuntu 20.04 LTS: USN-5998-1 Critical: Apache Log4j Security Issues Fix

ubuntu
Calendar Grey April 5, 2023
Scroller Ubuntu
Multiple crucial Apache Log4j vulnerabilities addressed in Ubuntu 20.04 USN-5998-1 patches for secure functionality.
Several security issues were fixed in Apache Log4j.

Summary

Several security issues were fixed in Apache Log4j.

Software Description:

- apache-log4j1.2: Java-based open-source logging tool

Details:

It was discovered that the SocketServer component of Apache Log4j 1.2

incorrectly handled deserialization. An attacker could possibly use this issue

to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.

(CVE-2019-17571)

It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly

handled deserialization. An attacker could possibly use this issue to execute

arbitrary code. (CVE-2022-23302)

It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL

statements. A remote attacker could possibly use this issue to perform an SQL

injection attack and alter the database. This issue was only fixed in Ubuntu

18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)

It was discovered that the Chainsaw component of Apache Log4j 1.2 incorrectly

handled deserialization. An attacker could possibly use this issue to exec...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory update critical Ubuntu SQL injection deserialization Apache Log4j

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  liblog4j1.2-java                1.2.17-9ubuntu0.2

Ubuntu 18.04 LTS:
  liblog4j1.2-java                1.2.17-8+deb10u1ubuntu0.2

Ubuntu 16.04 ESM:
  liblog4j1.2-java                1.2.17-7ubuntu1+esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5998-1

CVE-2019-17571, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307

Severity
critical
Lowest
Low
Medium
High
Critical

April 05, 2023

Topics%20covered

Topics Covered

security advisory update critical Ubuntu SQL injection deserialization Apache Log4j

Package Information

https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-9ubuntu0.2
https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1ubuntu0.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.