log4j CVEs

[Neustradamus]

New CVEs in log4j

• https://logging.apache.org/log4j/2.x/security.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

[Neustradamus]

I have update my ticket, there are 2 CVEs in few times, and previous too ;)

At this time, last current version is 2.16.0.

[prasket]

Saw your comments and wanted to drop a note about a new CVE which requires log4j > 2.17.0

• https://nvd.nist.gov/vuln/detail/CVE-2021-45105
• https://logging.apache.org/log4j/2.x/

[Neustradamus]

Log4j CVEs from 2021:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105

Fix:

• 2.17.1 (Java 8)
• 2.12.4 (Java 7)
• 2.3.2 (Java 6)