substitution is enabled.
DLA 2842-1: apache-log4j2 security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-2842-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
December 12, 2021 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : apache-log4j2
Version : 2.7-2+deb9u1
CVE ID : CVE-2021-44228
Debian Bug : 1001478
Chen Zhaojun of Alibaba Cloud Security Team discovered that JNDI features
used in configuration, log messages, and parameters do not protect
against attacker controlled LDAP and other JNDI related endpoints. An
attacker who can control log messages or log message parameters can
execute arbitrary code loaded from LDAP servers when message lookup
substitution is enabled.
For Debian 9 stretch, this problem has been fixed in version
2.7-2+deb9u1.
We recommend that you upgrade your apache-log4j2 packages.
For the detailed security status of apache-log4j2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apache-log4j2
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
