Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Apache Log4j: Multiple Vulnerabilities — GLSA 202402-16

Multiple vulnerabilities have been discovered in Apache Log4j, the worst of which can lead to remote code execution.

Affected packages

Package dev-java/log4j on all architectures
Affected versions <= 1.2.17
Unaffected versions

Background

Log4j is a Java logging framework that supports various use cases with a rich set of components, a separate API, and a performance-optimized implementation.

Description

Multiple vulnerabilities hav been discovered in Apache Log4j. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for log4j. We recommend that users unmerge it:

 # emerge --ask --depclean "dev-java/log4j"

References

Release date
February 18, 2024

Latest revision
February 18, 2024: 1

Severity
normal

Exploitable
remote

Bugzilla entries