Search for packages
| purl | pkg:maven/org.apache.logging.log4j/log4j@1.2 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-698m-2hju-2qcv
Aliases: CVE-2021-4104 GHSA-fp5r-v3w9-4333 |
Deserialization of Untrusted Data JMSAppender in Log4j is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide `TopicBindingName` and `TopicConnectionFactoryBindingName` configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j when specifically configured to use JMSAppender, which is not the default. Apache Log4j reached end of life in August Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. | There are no reported fixed by versions. |
|
VCID-bbq3-tx7c-yucn
Aliases: CVE-2022-23307 GHSA-f7vh-qwp3-x37m |
This advisory has been marked as False Positive and removed. |
Affected by 4 other vulnerabilities. |
|
VCID-zbwq-f71w-jqhy
Aliases: CVE-2019-17571 GHSA-2qrg-x229-3v8q |
Deserialization of Untrusted Data in Log4j Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17. Users are advised to migrate to `org.apache.logging.log4j:log4j-core`. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-02T12:36:16.516046+00:00 | GitLab Importer | Affected by | VCID-zbwq-f71w-jqhy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.logging.log4j/log4j/CVE-2019-17571.yml | 38.0.0 |
| 2026-04-01T12:49:18.310715+00:00 | GitLab Importer | Affected by | VCID-bbq3-tx7c-yucn | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.logging.log4j/log4j/CVE-2022-23307.yml | 38.0.0 |
| 2026-04-01T12:49:10.313180+00:00 | GitLab Importer | Affected by | VCID-698m-2hju-2qcv | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.logging.log4j/log4j/CVE-2021-4104.yml | 38.0.0 |