Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/log4j/log4j@1.2.0
purl pkg:maven/log4j/log4j@1.2.0
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-fp5r-v3w9-4333
Aliases:
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j … There are no reported fixed by versions.
CVE-2019-17571
Aliases:
GHSA-2qrg-x229-3v8q
Deserialization of Untrusted Data in Log4j Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of … There are no reported fixed by versions.
This package is not known to fix any advisories.