org.apache.logging.log4j:log4j-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 3 advisory(ies)
Advisories (12)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3pxv-7cmr-fjr4 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters | 2.0-alpha1 – < 2.25.4 ; 3.0.0-alpha1 – 3.0.0-beta3 | Not affected |
| GHSA-445c-vh5m-36rj Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility | 2.21.0 – < 2.25.4 ; 3.0.0-beta1 – 3.0.0-beta3 | Not affected |
| GHSA-6hg6-v5c8-fphq Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration | 2.12.0 – < 2.25.4 ; 3.0.0-alpha1 – 3.0.0-beta3 | Not affected |
| GHSA-7rjr-3q55-vv33 Incomplete fix for Apache Log4j vulnerability | 2.13.0 – < 2.16.0 ; 2.4.0 – < 2.12.2 ; < 2.3.1 | Affected |
| GHSA-8489-44mv-ggj8 Improper Input Validation and Injection in Apache Log4j2 | 2.0-beta7 – < 2.3.2 ; 2.4 – < 2.12.4 ; 2.13.0 – < 2.17.1 | Not affected |
| GHSA-fxph-q3j8-mv87 Deserialization of Untrusted Data in Log4j | 2.0 – < 2.8.2 | Not affected |
| GHSA-h383-gmxw-35v2 Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters | 2.7 – < 2.25.4 ; 3.0.0-beta1 – 3.0.0-beta2 | Not affected |
| GHSA-jfh8-c2jp-5v3q Remote code injection in Log4j | 2.13.0 – < 2.15.0 ; 2.0-beta9 – < 2.3.1 ; 2.4 – < 2.12.2 | Not affected |
| GHSA-p6xc-xr62-6r2g Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion | 2.4.0 – < 2.12.3 ; 2.13.0 – < 2.17.0 ; < 2.3.1 | Affected |
| GHSA-vc5p-v9hr-52mj Apache Log4j does not verify the TLS hostname in its Socket Appender | 2.0-beta9 – < 2.25.3 | Not affected |
| GHSA-vp98-w2p3-mv35 Apache Log4j 1.x (EOL) allows Denial of Service (DoS) | 1.0.4 – < 2.0 | Not affected |
| GHSA-vwqq-5vrc-xw9h Improper validation of certificate with host mismatch in Apache Log4j SMTP appender | 2.13.0 – < 2.13.2 ; 2.4.0 – < 2.12.3 ; < 2.3.2 | Affected |
Sources
| Source | Licence |
|---|