CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationįor a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities page.Ĭisco's Response to These VulnerabilitiesĬisco continues to assess all products and services for impact from both CVE-2021-44228 and CVE-2021-45046.On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation.On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack.On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed:
CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: Critical Vulnerabilities in Apache Log4j Java Logging Library
0 kommentar(er)
