tsaekao / verademo-java

The Veracode demo application. A simple Java Web App built using Spring MVC.
0 stars 0 forks source link

CVE: 2022-23302 found in Apache Log4j - Version: 1.2.17 [JAVA] #11

Open github-actions[bot] opened 10 months ago

github-actions[bot] commented 10 months ago

Veracode Software Composition Analysis

Attribute Details
Library Apache Log4j
Description Apache Log4j 1.2
Language JAVA
Vulnerability Deserialisation Of Untrusted Object
Vulnerability description JMSSink in log4j is vulnerable to deserialization of untrusted object. The insecure use of JNDI in JMSSink allows an attacker to send malicious object in LDAP store if it is accessible by an attacker or is configured to use an untrusted site, leading to a remote code execution. Note: this vulnerability only affects the applications specifically configured to use JMSSink, which is not the default.
CVE 2022-23302
CVSS score 6
Vulnerability present in version/s 1.1.3-1.2.17
Found library version/s 1.2.17
Vulnerability fixed in version
Library latest version 1.2.17
Fix No fix is released. Users should upgrade to Log4j 2 or remove usage of the JMSSink from their configurations.

Links:

github-actions[bot] commented 10 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/2

github-actions[bot] commented 10 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/43

github-actions[bot] commented 7 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/63

github-actions[bot] commented 7 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/64

github-actions[bot] commented 5 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/65

github-actions[bot] commented 5 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/67

github-actions[bot] commented 5 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/68

github-actions[bot] commented 4 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/69

github-actions[bot] commented 4 months ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/70

github-actions[bot] commented 1 month ago

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/71