When was Log4j 1.2 17 released?

What is the release date of Log4j 1.2 17

Release History

Version Date Description
1.2.17 2012-05-06 Maintenance release
1.2.16 2010-04-06 Maintenance release
1.2.15 2007-08-24 SyslogAppender enhancements, NTEventLogAppender and Maven build.
1.2.14 2006-09-18 AsyncAppender rewrite, Syslog and SMTPAppender enhancements.

Is Log4j 1.2 17 vulnerable or not

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

What is the version Log4j 1.2 17

Apache Log4j » 1.2. 17

License Apache 2.0
Files pom (21 KB) bundle (478 KB) View All
Repositories CentralApache PublicApache ReleasesApache StagingBeDataDrivenHortonworksMulesoftOrekitRedhat GASonatypeSpring Plugins
Ranking #16 in MvnRepository (See Top Artifacts) #3 in Logging Frameworks
Used By 18,289 artifacts

What replaces Log4j 1.2 17 jar

By drop-in, we mean that you can replace log4j. jar with reload4j. jar in your build with no source code changes, no recompilation, nor rebuild being necessary. The reload4j project offers a clear and easy migration path for the thousands of users who have an urgent need to fix vulnerabilities in log4j 1.2.

Is Log4j 1.2 end of life

Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.

Is Log4j 2.17 released

2.17. 0, released Friday, marks the third patch for Log4j since the now-infamous Log4Shell vulnerability became publicly known a week and a half ago. Log4j 2.15. 0 helped mitigate the initial remote code execution (RCE) vulnerability, tracked as CVE-2021-44228, while 2.16.

Does Log4j 1.2 14 have vulnerability

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. JMSSink in all versions of Log4j 1. x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.

What is the vulnerability of Log4j 1.2 15

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Is log4j 1.2 14 jar vulnerable

JMSAppender, in log4j 1.2 version, is vulnerable to deserialization of untrusted data if the attacker has the 'write' permissions to the log4j configuration.

Which version of log4j is affected

Technical Details. The CVE-2021-44228 RCE vulnerability—affecting Apache's Log4j library, versions 2.0-beta9 to 2.14.

What is the vulnerability of Log4j 1.2 12

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Is Log4j 2.17 0 vulnerable

TL;DR – The latest vulnerabilities found in Log4j 2.17. 0 are much less serious than the hype would suggest. Continue to patch your systems to at least Log4j 2.17. 0 (Java 8) or 2.12.

When was Log4j 2.16 0 released

2021-12-13

0 (2021-12-13)

Is log4j 1.2 end of life

Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CSM version 6.3.

What is the vulnerability of log4j 1.2 15

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Does Log4j 1.2 have vulnerability

JMSAppender, in log4j 1.2 version, is vulnerable to deserialization of untrusted data if the attacker has the 'write' permissions to the log4j configuration.

When was Log4j 2.17 0 released

2021-12-17

0 (2021-12-17) The major changes contained in this release include: Address CVE-2021-45105 by disabling recursive evaluation of Lookups during log event processing.

Is Log4j 2.16 still vulnerable

December 20, 2021

Log4j 2.17 has been released to address a Denial of Service (DoS) vulnerability found in v2. 16 and earlier. Log4j 2.16 and earlier does not always protect from infinite recursion in lookup evaluation, which can lead to DoS attacks. This is considered a High (7.5) vulnerability on the CVSS scale.

Is Log4j Core 2.17 0 jar vulnerable

3 or 2.17. 0: from these versions onwards, only the JAVA protocol is supported in JNDI connections. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

When was Log4j 2.16 released

0 (2021-12-13) This release contains one change which is noted below. Due to a break in compatibility in the SLF4J binding, Log4j now ships with two versions of the SLF4J to Log4j adapters.

What is the vulnerability of Log4j 1.2 14

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.