Ausführen beliebiger Kommandos in Log4j
ID: | USN-4495-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 18.04 LTS |
Datum: | Di, 15. September 2020, 22:55 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1build0.18.04.1 |
Applikationen: | Log4j |
Originalnachricht |
|
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============4107679504062367409== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT Content-Type: multipart/mixed; boundary="EKQgsDO4IizneT4wewilxbvbKS50CzB4C" --EKQgsDO4IizneT4wewilxbvbKS50CzB4C Content-Type: text/plain; charset=utf-8 Content-Language: en-U Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-4495-1 September 15, 2020 Apache Log4j vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: Apache Log4j could be made to remotely execute arbitrary code if it received specially crafted log data. Software Description: - apache-log4j1.2: Java-based open-source logging tool Details: It was discovered that Apache Log4j does not properly deserialize untrusted data. An attacker could possibly use this issue to remotely execute arbitrary code. (CVE-2019-17571) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: liblog4j1.2-java 1.2.17-8+deb10u1build0.18.04.1 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4495-1 CVE-2019-17571 Package Information: https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1build0.18.04.1 --EKQgsDO4IizneT4wewilxbvbKS50CzB4C-- --LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7MowLJorxPNkyBZZW+PTAFZKyRgFAl9g4roACgkQW+PTAFZK yRgOVhAAgfSD0NrKzjRqP3zEm7p+6KUXY9J0h/gaREn7KeaVItkyVyn0sQJcbLjZ jeGWpifP2CkIs2ouRDj218MUhX0JQfXDlu8Xw365667BoLQkCODDH/jHSl/fjh1O MNQkRM/DRSuNeT8PCyj4F8E/y02tZC1qudX5dyt+rgpwoV8PhiO1asfugFZjX8dm LCxtnDEnYTpZcd5JkdJ38Gc21TB1EG900haVeBaMCvEdJHrScolJgVoszs+Q/FNa CE6Niv55kBB81yGuJftqgNerThbl+cSgkyJtfffClRSpY7up664+EPHzGiCFbB+B wQD1qOQzkLn0mJqjwIC66hrWwrZaNeIShLv88IYUU9THIaY9P023oYhTlT1pSCNt butU5+da5dBgvAYnD9qHWvCZ7kCQmrqP6R20/q42+rbt7Kb0/Q8j9KvwH/jubL+l hsmtbKgcAYCEw8KRbKKvs4wbGKHorETT/AB1rHI6uN6Bq0PTpNUtQkZcYDTxvouk RMoZBB6qr7+O+TUWMz4m6f0mb271vUGy5IZeljSRqqKk36EGKMHVRa80zi0rvMA8 0MGqkAnERnVq30gEuvJ0+NT0Mi3eabRGZKCthyUn1iJrAaSnK4Gv5ZfnNTa+e0OC PeNvZPPlm16EsZArUIApZxIQU+p8mwenv5GFmgS25xK1W7baJDo= =RWn1 -----END PGP SIGNATURE----- --LhNY58JO2ah0gCxY1cLXXrNu3oC4qXcpT-- --===============4107679504062367409== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5 LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj dXJpdHktYW5ub3VuY2UK --===============4107679504062367409==-- |