USN-5223-1: Apache Log4j 1.2 vulnerability
12 January 2022
Apache Log4j 1.2 could be made to crash or run programs if it received specially crafted input.
- apache-log4j1.2 - Java-based open-source logging tool
It was discovered that Apache Log4j 1.2 was vulnerable to deserialization of
untrusted data if the configuration file was editable. An attacker could use
this vulnerability to cause a DoS or possibly execute arbitrary code.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-5223-2: liblog4j1.2-java, apache-log4j1.2, liblog4j1.2-java-doc