org.apache.logging.log4j:log4j-core vulnerabilities (TuxCare)
10 vulnerabilities.
-
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() 6.3 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout 6.3 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters 6.9 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters 6.9 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility 6.9 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass 6.3 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j Core: Missing TLS hostname verification in Socket appender 6.3 Medium -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack 9.0 Critical -
org.apache.logging.log4j:log4j-coreTuxCare Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints 10.0 Critical -
org.apache.logging.log4j:log4j-coreTuxCare Deserialization of Untrusted Data in Log4j 9.8 Critical