Is Log4j 1.2 vulnerable
JMSAppender, in log4j 1.2 version, is vulnerable to deserialization of untrusted data if the attacker has the 'write' permissions to the log4j configuration.
What version of Log4j has vulnerability
Technical Details. The CVE-2021-44228 RCE vulnerability—affecting Apache's Log4j library, versions 2.0-beta9 to 2.14. 1—exists in the action the Java Naming and Directory Interface (JNDI) takes to resolve variables.
What version of Log4j is not vulnerable
Log4j 1.
Log4j 1.
x does not have Lookups so the risk is lower. Applications using Log4j 1. x are only vulnerable to this attack when they use JNDI in their configuration. A separate CVE (CVE-2021-4104) has been filed for this vulnerability.
What is the vulnerability of Log4j 1.2 12
Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
Is Log4j 1.2 end of life
Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.
What is the vulnerability of Log4j 1.2 15
Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
Is Log4j 1.2 17 jar affected
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2. 17.
What is the replacement for Log4j 1.2 17
Initiated by Ceki Gülcü, the original author of Apache log4j 1. x, the reload4j project is a fork of Apache log4j version 1.2. 17 with the goal of fixing pressing security issues. Reload4j is a binary compatible, drop-in replacement for log4j version 1.2.
What is the version Log4j 1.2 17
Apache Log4j » 1.2. 17
| License | Apache 2.0 |
|---|---|
| Files | pom (21 KB) bundle (478 KB) View All |
| Repositories | CentralApache PublicApache ReleasesApache StagingBeDataDrivenHortonworksMulesoftOrekitRedhat GASonatypeSpring Plugins |
| Ranking | #16 in MvnRepository (See Top Artifacts) #3 in Logging Frameworks |
| Used By | 18,289 artifacts |
What replaces Log4j 1.2 17 jar
By drop-in, we mean that you can replace log4j. jar with reload4j. jar in your build with no source code changes, no recompilation, nor rebuild being necessary. The reload4j project offers a clear and easy migration path for the thousands of users who have an urgent need to fix vulnerabilities in log4j 1.2.
Is log4j 1.2 17 Safe
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.
Is log4j 1.2 end of life
Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.
Is Log4j 1.2 17 Secure
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.
What is the security issue of log4j 1.2 17
JMSSink in all versions of Log4j 1. x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.
What is the release date of log4j 1.2 17
Release History
| Version | Date | Description |
|---|---|---|
| 1.2.17 | 2012-05-06 | Maintenance release |
| 1.2.16 | 2010-04-06 | Maintenance release |
| 1.2.15 | 2007-08-24 | SyslogAppender enhancements, NTEventLogAppender and Maven build. |
| 1.2.14 | 2006-09-18 | AsyncAppender rewrite, Syslog and SMTPAppender enhancements. |
Is Log4j 1.2 17 Safe
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.
