What is GHSA-xxfh-x98p-j8fr?

GHSA-xxfh-x98p-j8fr is a security advisory published by GitHub Security Advisories with Critical severity. Remote code injection in Log4j (through pax-logging-log4j2)

Why does GHSA-xxfh-x98p-j8fr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-xxfh-x98p-j8fr?

GHSA-xxfh-x98p-j8fr affects 2 products, including: maven/org.ops4j.pax.logging:pax-logging-log4j2:\u003e= 2.0.0, \u003c 2.0.11; maven/org.ops4j.pax.logging:pax-logging-log4j2:\u003c 1.11.10.

GHSA-xxfh-x98p-j8frCriticalDisclosed before NVD

Remote code injection in Log4j (through pax-logging-log4j2)

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

January 9, 2023

📋 Description

Impact

Remote Code Execution.

Patches

Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.

Workarounds

Set system property -Dlog4j2.formatMsgNoLookups=true

References

https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

🎯 Affected products2

maven/org.ops4j.pax.logging:pax-logging-log4j2:>= 2.0.0, < 2.0.11
maven/org.ops4j.pax.logging:pax-logging-log4j2:< 1.11.10

🔗 References (3)

https://github.com/ops4j/org.ops4j.pax.logging/security/advisories/GHSA-xxfh-x98p-j8fr
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/advisories/GHSA-xxfh-x98p-j8fr