Ubuntu alert USN-7590-1 (apache-log4j1.2)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7590-1] Apache Log4j vulnerabilities
Date:
             
 
Mon, 23 Jun 2025 13:46:07 +0000
Message-ID:
             
 
<E1uThUt-0007V8-JD@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7590-1
June 23, 2025

apache-log4j1.2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Apache Log4j could be made to run programs as your login if it opened a
specially crafted file.

Software Description:
- apache-log4j1.2: Java-based open-source logging tool

Details:

It was discovered that several deserialization issues existed within Apache
Log4j. An attacker could possibly use these issues to enable the execution
of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS
  liblog4j1.2-java                1.2.17-4ubuntu3+esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7590-1
  CVE-2022-23302, CVE-2022-23305, CVE-2022-23307


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmhZWkoACgkQcpJm3tlz
hgFavRAAnAkGu2xdKV7q/e2NFQoez/1NhTU4X6CphgYP5anFWu788qULz7qHnvsn
EPsqrr1VnyxRXnP3GqRuO5zdcUf4yCq6RZhBSJz9VcanIE7Au9KZc6GMenomN6pg
bnRQdekllPiTEcAUqDqBlc7DXNqHHvOfQLsaxZSsUWC/xF+YAU2sV4SkGQ9AoNFn
rPZ4hJDbpdxOh5HHTiCe+TPpSFDxyn6c+kMH3YMvP6lvbCzyj053vRENoKXLgebv
LAPnz0RlfF0WtNDq3zekO0wxk4pBrjwmFaKh3hc4+k71mIECAukEgebE8RLa/T+q
plp20ySvB2jE2AAoXSzFlUnq00u0cPU9xrS7TQbHQtzpg2gS5GK8hnR6HPj2XdAf
OSGhLKmtw4Tc8rmRqkE9cn+1J/+u0TNwGnRtYWOlPvG6DSXFKlwy+K1mYEsjjNGI
tx0phr4enKsG1BAR8J96oXID1TXEpGBHoIZSa/1EJhCNLdNM+laMnFvn75C3qJ7H
wRRuGjvkj3+CuOLWDG2tM2Mx7y4/o5xLPELpMaK5zmRMBQPPlMkhiHJX4iYm+vKk
UzXpZwb9y6NMMKImbFLkhWaEaQCGJ/nIkhtXS2RNSYcNV9NRwdWEOMyFmg9VkAqe
D6ghib80F9HmGzgQQFAW3V0Q4B0Itb8+fE40H/gH+qKLmVYtSpY=
=54QQ
-----END PGP SIGNATURE-----