What versions of log4j are supported?

What versions of Log4j are affected

What happened to log4j recently

Is Log4j 2.17 vulnerable

3 or 2.17. 0: from these versions onwards, only the JAVA protocol is supported in JNDI connections. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

Does Log4j 1.2 17 have vulnerability

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Which version of Log4j is compatible with Java 7

Java Support

Log4j 2.13. 0 and greater require Java 8 or above. Log4j (2.4 – 2.12. 2) require Java 7 or above.

Is Log4j 2.16 still vulnerable

December 20, 2021

Log4j 2.17 has been released to address a Denial of Service (DoS) vulnerability found in v2. 16 and earlier. Log4j 2.16 and earlier does not always protect from infinite recursion in lookup evaluation, which can lead to DoS attacks. This is considered a High (7.5) vulnerability on the CVSS scale.

Is Log4j 1.2 12 vulnerable

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. How to fix Deserialization of Untrusted Data

Is Log4j 2.7 vulnerable

log4j:log4j-core is a logging library for Java. Affected versions of this package are vulnerable to Remote Code Execution (RCE). Apache Log4j2 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.

Is Log4j 1.2 end of life

Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.

Does Log4j 1.2 14 have vulnerability

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. JMSSink in all versions of Log4j 1. x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.

Is Log4j 2.17 compatible with Java 7

Apache Log4j 2.17. 0 requires a minimum of Java 8 to build and run. Log4j 2.12. 2 is the last release to support Java 7.

Is Log4j compatible with Java 11

Logging works fine on previous Java versions – 10, 9, 8, but not on Java 11.

Is Log4j 2.3 vulnerable

Affected versions of this package are vulnerable to Remote Code Execution (RCE). Apache Log4j2 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.

Is Log4j 2.17 released

2.17. 0, released Friday, marks the third patch for Log4j since the now-infamous Log4Shell vulnerability became publicly known a week and a half ago. Log4j 2.15. 0 helped mitigate the initial remote code execution (RCE) vulnerability, tracked as CVE-2021-44228, while 2.16.

Is log4j 1.2 end of life

Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.

Is log4j 2.16 vulnerable

Vulnerability Details

DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by the failure to protect from uncontrolled recursion from self-referential lookups.

Is Log4j 1.2 14 vulnerable

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Is 1.18 safe from Log4j

All servers running 1.18. 1 and above are completely safe. For those still running version 1.18 and older, part of the necessary fix is to add specific JVM arguments to your startup command line.

When was Log4j 2.17 released

0 (2021-12-17) The major changes contained in this release include: Address CVE-2021-45105 by disabling recursive evaluation of Lookups during log event processing.

Is Java 11 and Java 17 compatible

Java 17 is backwards-compatible with older Java versions, so existing modules will continue to work regardless of the compiler version used to create the module. Later this year, FirstSpirit artifacts like the isolated-runtime jar will require Java 17 to compile when used as a dependency in your project.

Can Java 8 jar run on Java 11

Java 11 is backwards compatible with Java 8. So you can swiftly change from Java 8 to 11. If you use some of the packages below, all you need to do is add the replacement dependency to your project. Also, Applets and Java Web Start are completely removed without a replacement.

When was Log4j 2.17 1 released

1 (2021-12-27) This release addresses CVE-2021-44832 and contains other minor fixes.

Is Log4j 1.2 6 vulnerable

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2. 17.

Is log4j Version 1.2 16 vulnerable

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Is Log4j 1.2 13 vulnerable

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

When was Log4j 2.16 released

0 (2021-12-13) This release contains one change which is noted below. Due to a break in compatibility in the SLF4J binding, Log4j now ships with two versions of the SLF4J to Log4j adapters.