You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vulnerable Package issue exists @ Maven-log4j:log4j-1.2.17 in branch main
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j 1.2 up to 1.2.17.
NOTE: log4j:log4j 1.2 is end-of-life since 2015 and will not be fixed.
MITIGATION: Migrate to org.apache.logging.log4j:log4j-core 2.8.2 or above.
Vulnerable Package issue exists @ Maven-log4j:log4j-1.2.17 in branch main
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j 1.2 up to 1.2.17.
NOTE: log4j:log4j 1.2 is end-of-life since 2015 and will not be fixed.
MITIGATION: Migrate to org.apache.logging.log4j:log4j-core 2.8.2 or above.
Namespace: Vadim-Sedletsky
Repository: astlab2
Repository Url: https://github.com/Vadim-Sedletsky/astlab2
CxAST-Project: Vadim-Sedletsky/astlab2
CxAST platform scan: 04a30340-6739-42e6-9af3-70d57f362405
Branch: main
Application: astlab2
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-502
Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
References
Mail Thread
Release Note
Issue
Commit
Advisory
The text was updated successfully, but these errors were encountered: