drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Log4j
Name: |
Ausführen beliebiger Kommandos in Log4j |
|
ID: |
USN-4495-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 18.04 LTS |
|
Datum: |
Di, 15. September 2020, 22:55 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1build0.18.04.1 |
|
Applikationen: |
Log4j |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============4107679504062367409== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT Content-Type: multipart/mixed; boundary="EKQgsDO4IizneT4wewilxbvbKS50CzB4C"
--EKQgsDO4IizneT4wewilxbvbKS50CzB4C Content-Type: text/plain; charset=utf-8 Content-Language: en-U Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-4495-1 September 15, 2020
Apache Log4j vulnerability ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Apache Log4j could be made to remotely execute arbitrary code if it received specially crafted log data.
Software Description: - apache-log4j1.2: Java-based open-source logging tool
Details:
It was discovered that Apache Log4j does not properly deserialize untrusted data. An attacker could possibly use this issue to remotely execute arbitrary code. (CVE-2019-17571)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04 LTS: liblog4j1.2-java 1.2.17-8+deb10u1build0.18.04.1
In general, a standard system update will make all the necessary changes.
References: https://usn.ubuntu.com/4495-1 CVE-2019-17571
Package Information:
https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1build0.18.04.1
--EKQgsDO4IizneT4wewilxbvbKS50CzB4C--
--LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7MowLJorxPNkyBZZW+PTAFZKyRgFAl9g4roACgkQW+PTAFZK yRgOVhAAgfSD0NrKzjRqP3zEm7p+6KUXY9J0h/gaREn7KeaVItkyVyn0sQJcbLjZ jeGWpifP2CkIs2ouRDj218MUhX0JQfXDlu8Xw365667BoLQkCODDH/jHSl/fjh1O MNQkRM/DRSuNeT8PCyj4F8E/y02tZC1qudX5dyt+rgpwoV8PhiO1asfugFZjX8dm LCxtnDEnYTpZcd5JkdJ38Gc21TB1EG900haVeBaMCvEdJHrScolJgVoszs+Q/FNa CE6Niv55kBB81yGuJftqgNerThbl+cSgkyJtfffClRSpY7up664+EPHzGiCFbB+B wQD1qOQzkLn0mJqjwIC66hrWwrZaNeIShLv88IYUU9THIaY9P023oYhTlT1pSCNt butU5+da5dBgvAYnD9qHWvCZ7kCQmrqP6R20/q42+rbt7Kb0/Q8j9KvwH/jubL+l hsmtbKgcAYCEw8KRbKKvs4wbGKHorETT/AB1rHI6uN6Bq0PTpNUtQkZcYDTxvouk RMoZBB6qr7+O+TUWMz4m6f0mb271vUGy5IZeljSRqqKk36EGKMHVRa80zi0rvMA8 0MGqkAnERnVq30gEuvJ0+NT0Mi3eabRGZKCthyUn1iJrAaSnK4Gv5ZfnNTa+e0OC PeNvZPPlm16EsZArUIApZxIQU+p8mwenv5GFmgS25xK1W7baJDo= =RWn1 -----END PGP SIGNATURE-----
--LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT--
--===============4107679504062367409== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5 LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj dXJpdHktYW5ub3VuY2UK
--===============4107679504062367409==--
|
|
|
|