Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.logging.log4j/log4j-core@2.4.0
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.4.0
Tags Ghost
Next non-vulnerable version 2.25.4
Latest non-vulnerable version 2.25.4
Risk score 10.0
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
GHSA-p6xc-xr62-6r2g
Aliases:
CVE-2021-45105
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not …
2.12.3
Vulnerable
GHSA-vwqq-5vrc-xw9h
Aliases:
CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an …
2.12.3
Vulnerable
CVE-2021-44832
Aliases:
GHSA-8489-44mv-ggj8
Improper Input Validation and Injection in Apache Log4j2 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and …
2.17.1
Vulnerable
2.3.2
Vulnerable
2.12.4
Vulnerable
2.17.1
Vulnerable
2.3.2
Vulnerable
2.12.4
Vulnerable
GHSA-7rjr-3q55-vv33
Aliases:
CVE-2021-45046
Incomplete fix for Apache Log4j vulnerability # Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in …
2.12.2
Vulnerable
This package is not known to fix any advisories.