GitHub Advisoryadvisory · Maven

GHSA-xxfh-x98p-j8fr Remote code injection in Log4j (through pax-logging-log4j2)

CRITICAL Published 2021-12-10 Modified 2021-12-11 Official page ↗

Ecosystem: Maven
Packages: org.ops4j.pax.logging:pax-logging-log4j2
Severity: Critical
Reviewed: 2021-12-10

Affected packages

• Maven org.ops4j.pax.logging:pax-logging-log4j2: >= 2.0.0, < 2.0.11 → fixed in 2.0.11 • Maven org.ops4j.pax.logging:pax-logging-log4j2: < 1.11.10 → fixed in 1.11.10

Description

Impact Remote Code Execution. Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11. Workarounds Set system property `-Dlog4j2.formatMsgNoLookups=true` References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

References

https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr web
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q advisory
https://github.com/ops4j/org.ops4j.pax.logging package