GHSA-f7vh-qwp3-x37mCriticalCVSS 9.8

Deserialization of Untrusted Data in Apache Log4j

Published
January 19, 2022
Last Modified
October 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-23307 →

📋 Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Users are advised to migrate from log4j:log4j to org.apache.logging.log4j:log4j for an updated version of the library.

🎯 Affected products2

  • maven/log4j:log4j:<= 1.2.17
  • maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17:<= 2.0

🔗 References (6)