SCIENTIFIC-LINUX-ERRATA Archives

August 2017

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Important: log4j on SL7.x (noarch)
From:
Pat Riehecky <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Mon, 21 Aug 2017 15:40:34 -0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (23 lines) 
Synopsis:          Important: log4j security update
Advisory ID:       SLSA-2017:2423-1
Issue Date:        2017-08-07
CVE Numbers:       CVE-2017-5645
--

Security Fix(es):

* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
--

SL7
  noarch
    log4j-1.2.17-16.el7_4.noarch.rpm
    log4j-javadoc-1.2.17-16.el7_4.noarch.rpm
    log4j-manual-1.2.17-16.el7_4.noarch.rpm

- Scientific Linux Development Team

ATOM RSS1 RSS2