Advisories » MGASA-2021-0572

Updated log4j packages fix security vulnerability

Publication date: 20 Dec 2021
Modification date: 20 Dec 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-45105

Description

Updated log4j packages fix security vulnerability:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from
uncontrolled recursion from self-referential lookups. This allows an
attacker with control over Thread Context Map data to cause a denial
of service when a crafted string is interpreted (CVE-2021-45105).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=29786
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105

SRPMS

8/core

• log4j-2.17.0-1.mga8