USN-4495-1: Apache Log4j vulnerability

15 September 2020

Apache Log4j could be made to remotely execute arbitrary code if it received specially crafted log data.

Releases

Packages

  • apache-log4j1.2 - Java-based open-source logging tool

Details

It was discovered that Apache Log4j does not properly deserialize
untrusted data. An attacker could possibly use this issue to remotely
execute arbitrary code. (CVE-2019-17571)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

In general, a standard system update will make all the necessary changes.

References