You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@ofbiz.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2022/01/06 13:20:00 UTC

[jira] [Commented] (OFBIZ-12470) [SECURITY] CVE-2021-45105: Apache Log4j2

    [ https://issues.apache.org/jira/browse/OFBIZ-12470?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17469909#comment-17469909 ] 

ASF subversion and git services commented on OFBIZ-12470:
---------------------------------------------------------

Commit 00896e73bce0ab3cb9541c37a4405b23d32911c0 in ofbiz-framework's branch refs/heads/release17.12 from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=00896e7 ]

Fixed: Announce 17.12.09 EOL (OFBIZ-12479)

Includes:
[SECURITY] CVE-2021-44228: Apache Log4j2 (OFBIZ-12449)
[SECURITY] CVE-2021-45105: Apache Log4j2 (OFBIZ-12470)
[SECURITY] Update TIka because of Apache Log4j2 vulnerability (OFBIZ-12474)
[SECURITY] CVE-2021-44832: Apache Log4j2 (OFBIZ-12475)


> [SECURITY] CVE-2021-45105: Apache Log4j2
> ----------------------------------------
>
>                 Key: OFBIZ-12470
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12470
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: ALL COMPONENTS
>    Affects Versions: 18.12.03
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Blocker
>             Fix For: 18.12.04
>
>
> CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 does not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue is fixed in Log4j 2.17.0.: https://logging.apache.org/log4j/2.x/security.html



--
This message was sent by Atlassian Jira
(v8.20.1#820001)