GHSA-f7vh-qwp3-x37m
Deserialization of Untrusted Data in Apache Log4j
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | log4j:log4j | <= 1.2.17 | no fix listed |
| Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | <= 2.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Users are advised to migrate from `log4j:log4j` to `org.apache.logging.log4j:log4j` for an updated version of the library.
References
External links from the advisory. They lead to third-party sites.