GHSA-xxfh-x98p-j8fr
Remote code injection in Log4j (through pax-logging-log4j2)
GHSA-xxfh-x98p-j8fr is a vulnerability with no CVSS score yet in org.ops4j.pax.logging:pax-logging-log4j2, published December 10, 2021. No source lists public exploit code. Fixed in org.ops4j.pax.logging:pax-logging-log4j2 2.0.11.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.11org.ops4j.pax.logging:pax-logging-log4j2 +3 more
Description
Impact
Remote Code Execution.
Patches
Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.
Workarounds
Set system property -Dlog4j2.formatMsgNoLookups=true
References
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.ops4j.pax.logging:pax-logging-log4j2Maven | 2.0.0 up to 2.0.11 | 2.0.11 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | before 1.11.10 | 1.11.10 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | 2.0.0 up to 2.0.11, plus listed versions 2.0.12.0.102.0.22.0.32.0.4 Show 5 moreShow less2.0.52.0.62.0.72.0.82.0.9 | 2.0.11 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | before 1.11.10, plus listed versions 1.10.01.10.11.10.101.10.21.10.3 Show 27 moreShow less1.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.11.11.21.11.31.11.41.11.51.11.61.11.71.11.81.11.91.8.01.8.11.8.21.8.31.8.41.8.51.8.61.8.71.9.01.9.11.9.2 | 1.11.10 |
What each source reports
GitHub AdvisoriesNo score
Remote code injection in Log4j (through pax-logging-log4j2)
Impact
Remote Code Execution.
Patches
Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.
Workarounds
Set system property -Dlog4j2.formatMsgNoLookups=true
References
- Record
GHSA-xxfh-x98p-j8fr- Updated
- 2026-11-02
OSVNo score
Remote code injection in Log4j (through pax-logging-log4j2)
Impact
Remote Code Execution.
Patches
Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.
Workarounds
Set system property -Dlog4j2.formatMsgNoLookups=true
References
- Record
GHSA-xxfh-x98p-j8fr- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.