GHSA-xxfh-x98p-j8fr Remote code injection in Log4j (through pax-logging-log4j2)
Attackers can execute arbitrary code remotely via Log4j injection in pax-logging, requiring immediate library upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xxfh-x98p-j8fr?
GHSA-xxfh-x98p-j8fr is a code injection vulnerability in org.ops4j.pax.logging:pax-logging-log4j2, published on 10 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Remote Code Execution.
Patches
Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11.
Workarounds
Set system property -Dlog4j2.formatMsgNoLookups=true
References
Which versions are affected by GHSA-xxfh-x98p-j8fr?
4 open source packages ship an affected version, including org.ops4j.pax.logging:pax-logging-log4j2.
| Package | Affected | Fixed in |
|---|---|---|
org.ops4j.pax.logging:pax-logging-log4j2 Maven | All versions | 1.11.10 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | All versions | 1.11.10 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.11 |
org.ops4j.pax.logging:pax-logging-log4j2 Maven | From 2.0.0 | 2.0.11 |
How do I fix GHSA-xxfh-x98p-j8fr?
Upgrade org.ops4j.pax.logging:pax-logging-log4j2 to a fixed version for your release line: 1.11.10 or 2.0.11.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-xxfh-x98p-j8fr being exploited?
There is no known exploitation of GHSA-xxfh-x98p-j8fr in the wild and no public exploit code.