GHSA-f7vh-qwp3-x37m
Suggest an improvement- Source
- https://github.com/advisories/GHSA-f7vh-qwp3-x37m
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-f7vh-qwp3-x37m/GHSA-f7vh-qwp3-x37m.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-f7vh-qwp3-x37m
- Aliases
- Published
- 2022-01-19T00:01:15Z
- Modified
- 2023-11-01T05:44:47.251202Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Deserialization of Untrusted Data in Apache Log4j
- Details
-
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Users are advised to migrate from
log4j:log4jtoorg.apache.logging.log4j:log4jfor an updated version of the library. - References
Affected packages
Maven / log4j:log4j
Package
- Name
- log4j:log4j
- View open source insights on deps.dev
- Purl
- pkg:maven/log4j/log4j
Maven / org.zenframework.z8.dependencies.commons:log4j-1.2.17
Package
- Name
- org.zenframework.z8.dependencies.commons:log4j-1.2.17
- View open source insights on deps.dev
- Purl
- pkg:maven/org.zenframework.z8.dependencies.commons/log4j-1.2.17