Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-zbwq-f71w-jqhy
Aliases:
CVE-2019-17571
GHSA-2qrg-x229-3v8q
|
Deserialization of Untrusted Data in Log4j
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.
Users are advised to migrate to `org.apache.logging.log4j:log4j-core`.
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|