fad-checker 2.2.0 → 2.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -117
- package/completions/fad-checker.bash +1 -1
- package/completions/fad-checker.zsh +1 -0
- package/fad-checker.js +122 -16
- package/lib/codecs/npm.codec.js +2 -2
- package/lib/cve-match.js +10 -5
- package/lib/cve-report.js +65 -20
- package/lib/embedded.js +57 -0
- package/lib/json-export.js +7 -1
- package/lib/manifest-copy.js +75 -0
- package/lib/maven-bom.js +104 -0
- package/lib/outdated.js +19 -7
- package/lib/retire.js +95 -10
- package/lib/scan-completeness.js +15 -6
- package/lib/transitive.js +9 -2
- package/lib/ui.js +4 -3
- package/lib/version-overlay.js +193 -0
- package/package.json +1 -1
- package/fad-checker-report/cve-report.doc +0 -1168
- package/fad-checker-report/cve-report.html +0 -1293
|
@@ -1,1293 +0,0 @@
|
|
|
1
|
-
<!doctype html>
|
|
2
|
-
<html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>
|
|
3
|
-
* { box-sizing: border-box; }
|
|
4
|
-
body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; color: #1f2937; margin: 24px; background: #f9fafb; }
|
|
5
|
-
.report-header { border-bottom: 3px solid #6366f1; padding-bottom: 16px; margin-bottom: 20px; }
|
|
6
|
-
h1 { margin: 0 0 4px 0; font-size: 28px; letter-spacing: -.5px; }
|
|
7
|
-
.report-subtitle { color: #6b7280; font-size: 14px; font-weight: 500; margin-bottom: 12px; letter-spacing: .3px; }
|
|
8
|
-
h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; padding-bottom: 6px; }
|
|
9
|
-
.meta { color: #6b7280; font-size: 13px; margin-bottom: 16px; }
|
|
10
|
-
.summary { display: flex; flex-wrap: wrap; gap: 12px; margin: 16px 0; }
|
|
11
|
-
.summary .card { padding: 10px 16px; border-radius: 6px; background: #fff; border: 1px solid #e5e7eb; min-width: 120px; }
|
|
12
|
-
.summary .card .v { font-size: 24px; font-weight: 700; }
|
|
13
|
-
.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .5px; }
|
|
14
|
-
.summary .card.sev-critical { border-left: 4px solid #dc2626; }
|
|
15
|
-
.summary .card.sev-critical .v { color: #dc2626; }
|
|
16
|
-
.summary .card.sev-high { border-left: 4px solid #f97316; }
|
|
17
|
-
.summary .card.sev-high .v { color: #f97316; }
|
|
18
|
-
.summary .card.sev-medium { border-left: 4px solid #f59e0b; }
|
|
19
|
-
.summary .card.sev-medium .v { color: #b45309; }
|
|
20
|
-
.summary .card.sev-low { border-left: 4px solid #2563eb; }
|
|
21
|
-
.summary .card.sev-low .v { color: #2563eb; }
|
|
22
|
-
.summary .card.sev-vendored { border-left: 4px solid #6366f1; }
|
|
23
|
-
.summary .card.sev-warn { border-left: 4px solid #f59e0b; background: #fffbeb; }
|
|
24
|
-
.toc { position: sticky; top: 0; z-index: 50; background: #fff; border: 1px solid #e5e7eb; border-radius: 6px; padding: 8px 12px; margin: 16px 0; display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; box-shadow: 0 1px 4px rgba(0,0,0,.04); }
|
|
25
|
-
.toc a { color: #4338ca; text-decoration: none; padding: 2px 6px; border-radius: 3px; }
|
|
26
|
-
.toc a:hover { background: #eef2ff; }
|
|
27
|
-
.exec-summary .exec-top { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
|
|
28
|
-
.exec-summary .exec-top-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
|
|
29
|
-
.exec-summary .exec-top-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
|
|
30
|
-
.exec-summary .exec-top-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
|
|
31
|
-
.exec-summary .exec-cve-link { color: #1d4ed8; text-decoration: none; font-weight: 600; }
|
|
32
|
-
.exec-summary .exec-cve-link:hover { text-decoration: underline; }
|
|
33
|
-
.exec-summary .exec-ver { color: #6b7280; }
|
|
34
|
-
.exec-summary .exec-fix { color: #065f46; font-weight: 600; }
|
|
35
|
-
.fp-intro { background: #f3f4f6; border-left: 3px solid #6b7280; padding: 10px 14px; margin: 8px 0 16px; font-size: 12px; color: #4b5563; line-height: 1.5; }
|
|
36
|
-
td.prio { white-space: normal; }
|
|
37
|
-
td.prio .prio-band { white-space: nowrap; }
|
|
38
|
-
td.prio .kev-chip { display: block; margin-top: 3px; font-size: 10px; font-weight: 700; color: #7c0008; white-space: nowrap; }
|
|
39
|
-
td.prio .epss-chip { display: block; margin-top: 2px; font-size: 10px; color: #6b7280; font-family: ui-monospace, monospace; white-space: nowrap; }
|
|
40
|
-
.summary .card.sev-kev { border-left: 4px solid #7c0008; background: #fff1f2; }
|
|
41
|
-
.summary .card.sev-kev .v { color: #7c0008; }
|
|
42
|
-
.lic-group { margin: 14px 0; }
|
|
43
|
-
.lic-group .lic-h { font-size: 14px; margin: 8px 0 4px; padding: 4px 8px; border-radius: 4px; }
|
|
44
|
-
.lic-group .lic-n { font-size: 11px; color: #6b7280; font-weight: 500; }
|
|
45
|
-
.lic-group.lic-strong .lic-h { background: #fee2e2; color: #7c0008; }
|
|
46
|
-
.lic-group.lic-weak .lic-h { background: #fef3c7; color: #92400e; }
|
|
47
|
-
.lic-group.lic-unknown .lic-h { background: #e5e7eb; color: #374151; }
|
|
48
|
-
.lic-group.lic-ok .lic-h { background: #dcfce7; color: #065f46; }
|
|
49
|
-
td.cwe { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; }
|
|
50
|
-
td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
|
|
51
|
-
td.cwe .cwe-link:hover { text-decoration: underline; }
|
|
52
|
-
td.cwe .cwe-empty { color: #d1d5db; }
|
|
53
|
-
td.cwe .cwe-more { color: #9ca3af; font-style: italic; font-size: 10px; }
|
|
54
|
-
td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; font-size: 10px; color: #6b7280; line-height: 1.3; margin-top: 1px; max-width: 220px; }
|
|
55
|
-
.cwe-list { list-style: none; padding: 0; margin: 0; }
|
|
56
|
-
.cwe-list li { padding: 3px 0; font-size: 12px; line-height: 1.5; }
|
|
57
|
-
.cwe-list li .cwe-link { font-family: ui-monospace, monospace; color: #4338ca; text-decoration: none; font-weight: 600; }
|
|
58
|
-
.cwe-list li .cwe-link:hover { text-decoration: underline; }
|
|
59
|
-
.cwe-list li .cwe-name-inline { color: #374151; }
|
|
60
|
-
.cwe-list li .cwe-empty { color: #9ca3af; font-style: italic; }
|
|
61
|
-
/* CWE chip in the exec summary */
|
|
62
|
-
.exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
|
|
63
|
-
.exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
|
|
64
|
-
.exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
|
|
65
|
-
td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
|
|
66
|
-
tr.cve-row.cpe-fp td { opacity: .55; }
|
|
67
|
-
.jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
|
|
68
|
-
.jump-badge.jump-major { background: #fee2e2; color: #991b1b; }
|
|
69
|
-
.jump-badge.jump-minor { background: #fef3c7; color: #92400e; }
|
|
70
|
-
.jump-badge.jump-patch { background: #e0f2fe; color: #075985; }
|
|
71
|
-
.jump-badge.jump-pre, .jump-badge.jump-unknown { background: #f3f4f6; color: #6b7280; }
|
|
72
|
-
tr.jump-patch td, tr.jump-pre td, tr.jump-unknown td { opacity: .75; }
|
|
73
|
-
tr.cve-row .cpe-tag { display: inline-block; margin-top: 2px; font-size: 9px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; background: #f3f4f6; color: #6b7280; padding: 1px 5px; border-radius: 3px; }
|
|
74
|
-
table { width: 100%; border-collapse: collapse; background: #fff; margin: 8px 0 24px; font-size: 13px; }
|
|
75
|
-
th, td { padding: 8px 10px; text-align: left; border-bottom: 1px solid #e5e7eb; vertical-align: top; }
|
|
76
|
-
th { background: #f3f4f6; font-weight: 600; font-size: 11px; text-transform: uppercase; letter-spacing: .5px; color: #4b5563; }
|
|
77
|
-
tr:nth-child(even) { background: #fafafa; }
|
|
78
|
-
td.dep { font-family: ui-monospace, monospace; font-size: 12px; }
|
|
79
|
-
.defined-in { margin-top: 4px; font-family: ui-monospace, monospace; font-size: 10px; color: #6b7280; line-height: 1.4; }
|
|
80
|
-
.defined-in .defined-label { color: #9ca3af; font-family: -apple-system, "Segoe UI", Roboto, sans-serif; text-transform: uppercase; letter-spacing: .4px; font-size: 9px; margin-right: 4px; }
|
|
81
|
-
.defined-in code { background: #f3f4f6; padding: 1px 4px; border-radius: 3px; color: #374151; word-break: break-all; }
|
|
82
|
-
code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background: #f3f4f6; padding: 1px 6px; border-radius: 3px; color: #1f2937; font-weight: 400; }
|
|
83
|
-
.exec-summary { border: 1px solid #e5e7eb; border-radius: 8px; padding: 16px 20px; margin: 16px 0; background: #fff; display: flex; flex-direction: column; gap: 8px; }
|
|
84
|
-
.exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
|
|
85
|
-
.exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
|
|
86
|
-
.exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
|
|
87
|
-
.exec-summary .exec-copy-btn { margin-left: auto; }
|
|
88
|
-
.exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
|
|
89
|
-
.exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
|
|
90
|
-
.exec-summary.exec-critical { border-color: #dc2626; }
|
|
91
|
-
.exec-summary.exec-critical .exec-level { background: #dc2626; color: #fff; }
|
|
92
|
-
.exec-summary.exec-high { border-color: #f97316; }
|
|
93
|
-
.exec-summary.exec-high .exec-level { background: #f97316; color: #fff; }
|
|
94
|
-
.exec-summary.exec-medium { border-color: #f59e0b; }
|
|
95
|
-
.exec-summary.exec-medium .exec-level { background: #f59e0b; color: #fff; }
|
|
96
|
-
.exec-summary.exec-low { border-color: #2563eb; }
|
|
97
|
-
.exec-summary.exec-low .exec-level { background: #2563eb; color: #fff; }
|
|
98
|
-
.exec-summary.exec-info { border-color: #10b981; }
|
|
99
|
-
.exec-summary.exec-info .exec-level { background: #10b981; color: #fff; }
|
|
100
|
-
.exec-summary.exec-unknown { border-color: #6b7280; }
|
|
101
|
-
.exec-summary.exec-unknown .exec-level { background: #6b7280; color: #fff; }
|
|
102
|
-
.defined-in .defined-more { color: #9ca3af; font-style: italic; }
|
|
103
|
-
td.cve a { color: #1d4ed8; text-decoration: none; font-family: ui-monospace, monospace; }
|
|
104
|
-
td.cve a:hover { text-decoration: underline; }
|
|
105
|
-
td.desc { color: #4b5563; max-width: 480px; }
|
|
106
|
-
.empty { color: #9ca3af; font-style: italic; padding: 12px 0; }
|
|
107
|
-
.warnings { background: #fffbeb; border: 1px solid #fcd34d; padding: 12px 16px; border-radius: 6px; margin: 16px 0; }
|
|
108
|
-
.warnings h3 { margin: 0 0 10px; font-size: 14px; color: #92400e; }
|
|
109
|
-
.warnings .warn-block { background: #fff; border-left: 3px solid #f59e0b; padding: 8px 12px; margin: 8px 0; border-radius: 0 4px 4px 0; }
|
|
110
|
-
.warnings .warn-block.warn-unresolved-versions { border-left-color: #ef4444; background: #fef2f2; }
|
|
111
|
-
.warnings .warn-block.warn-private-libs { border-left-color: #6366f1; background: #eef2ff; }
|
|
112
|
-
.warnings .warn-head { font-size: 13px; color: #92400e; margin-bottom: 4px; }
|
|
113
|
-
.warnings .warn-unresolved-versions .warn-head { color: #991b1b; }
|
|
114
|
-
.warnings .warn-private-libs .warn-head { color: #312e81; }
|
|
115
|
-
.warnings .warn-private-libs code { background: #e0e7ff; }
|
|
116
|
-
.warnings .warn-defined { font-size: 10px; color: #6b7280; margin-top: 2px; padding-left: 14px; }
|
|
117
|
-
.warnings .warn-defined code.path { background: #f3f4f6; color: #374151; font-size: 10px; padding: 1px 4px; }
|
|
118
|
-
.warnings .warn-defined-more { color: #9ca3af; font-style: italic; }
|
|
119
|
-
.warnings .count { color: #6b7280; font-weight: 400; }
|
|
120
|
-
.warnings .warn-path { font-size: 11px; color: #6b7280; margin-bottom: 4px; }
|
|
121
|
-
.warnings .warn-msg { font-size: 12px; color: #374151; line-height: 1.45; }
|
|
122
|
-
.warnings .warn-items { margin: 6px 0 0; padding-left: 18px; font-size: 11px; max-height: 180px; overflow: auto; }
|
|
123
|
-
.warnings .warn-items li { margin-bottom: 2px; }
|
|
124
|
-
.warnings .warn-items .more { color: #6b7280; font-style: italic; }
|
|
125
|
-
.warnings code { background: #fef3c7; padding: 1px 4px; border-radius: 3px; font-size: 11px; }
|
|
126
|
-
.warnings .warn-unresolved-versions code { background: #fecaca; }
|
|
127
|
-
.confidence { font-size: 10px; color: #9ca3af; text-transform: uppercase; }
|
|
128
|
-
.source { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; background: #e5e7eb; color: #374151; margin: 1px 2px 1px 0; }
|
|
129
|
-
.source.both { background: #c7d2fe; color: #312e81; }
|
|
130
|
-
.source.snyk { background: #fce7f3; color: #831843; }
|
|
131
|
-
.source.osv { background: #dcfce7; color: #166534; }
|
|
132
|
-
.source.fad { background: #fef3c7; color: #92400e; }
|
|
133
|
-
.source.nvd { background: #cffafe; color: #155e75; }
|
|
134
|
-
.chip { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; margin-left: 4px; }
|
|
135
|
-
.chip.transitive { background: #fef3c7; color: #92400e; }
|
|
136
|
-
.chip.direct { background: #d1fae5; color: #065f46; }
|
|
137
|
-
.chip.parent { background: #ddd6fe; color: #5b21b6; }
|
|
138
|
-
/* Maven / npm scope qualifiers added next to .chip.direct when relevant */
|
|
139
|
-
.chip.scope-test { background: #fee2e2; color: #991b1b; }
|
|
140
|
-
.chip.scope-provided { background: #fed7aa; color: #9a3412; }
|
|
141
|
-
.chip.scope-runtime { background: #cffafe; color: #155e75; }
|
|
142
|
-
.chip.scope-system { background: #f3f4f6; color: #4b5563; }
|
|
143
|
-
.chip.scope-dev { background: #fee2e2; color: #991b1b; }
|
|
144
|
-
.chip.scope-peer { background: #ede9fe; color: #5b21b6; }
|
|
145
|
-
.chip.scope-optional { background: #f3f4f6; color: #6b7280; }
|
|
146
|
-
.chip.scope-vendored { background: #e0e7ff; color: #3730a3; }
|
|
147
|
-
.via { font-size: 10px; color: #6b7280; margin-top: 2px; font-family: ui-monospace, monospace; max-width: 220px; word-break: break-all; }
|
|
148
|
-
h3 { margin: 24px 0 10px; font-size: 16px; color: #374151; }
|
|
149
|
-
details.report-section { margin: 28px 0 0; }
|
|
150
|
-
details.report-section[open] { margin-bottom: 8px; }
|
|
151
|
-
details.report-section > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
|
|
152
|
-
details.report-section > summary::-webkit-details-marker { display: none; }
|
|
153
|
-
details.report-section > summary h2 { margin: 0; display: flex; align-items: center; gap: 8px; }
|
|
154
|
-
details.report-section > summary h2::before { content: "▾"; color: #6366f1; font-size: 14px; transition: transform .15s ease; display: inline-block; }
|
|
155
|
-
details.report-section:not([open]) > summary h2::before { transform: rotate(-90deg); }
|
|
156
|
-
details.report-section > summary:hover h2 { color: #4338ca; }
|
|
157
|
-
details.report-subsection { margin: 16px 0 0; }
|
|
158
|
-
details.report-subsection > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
|
|
159
|
-
details.report-subsection > summary::-webkit-details-marker { display: none; }
|
|
160
|
-
details.report-subsection > summary h3 { margin: 0; display: flex; align-items: center; gap: 8px; }
|
|
161
|
-
details.report-subsection > summary h3::before { content: "▾"; color: #9ca3af; font-size: 12px; transition: transform .15s ease; display: inline-block; }
|
|
162
|
-
details.report-subsection:not([open]) > summary h3::before { transform: rotate(-90deg); }
|
|
163
|
-
details.report-subsection > summary:hover h3 { color: #4b5563; }
|
|
164
|
-
/* Hierarchical indentation: every subsection's content gets a padded,
|
|
165
|
-
bordered container. Nested subsections inherit + add to the indent so
|
|
166
|
-
children visually nest under their parent. */
|
|
167
|
-
details.report-subsection > div { padding-left: 22px; margin-left: 6px; border-left: 2px solid #f3f4f6; padding-top: 4px; }
|
|
168
|
-
details.report-subsection details.report-subsection > summary h3 { font-size: 14px; color: #4b5563; }
|
|
169
|
-
details.report-subsection details.report-subsection details.report-subsection > summary h3 { font-size: 13px; color: #6b7280; font-weight: 500; }
|
|
170
|
-
details.report-subsection details.report-subsection > div { border-left-color: #e5e7eb; }
|
|
171
|
-
details.report-subsection details.report-subsection details.report-subsection > div { border-left-color: #d1d5db; }
|
|
172
|
-
.toolbar { display: flex; gap: 8px; margin: 12px 0 8px; flex-wrap: wrap; align-items: center; }
|
|
173
|
-
.toolbar .btn { display: inline-flex; align-items: center; gap: 4px; padding: 5px 12px; font-size: 12px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #374151; font-family: inherit; }
|
|
174
|
-
.toolbar .btn:hover { background: #f3f4f6; border-color: #9ca3af; }
|
|
175
|
-
.toolbar .btn.primary { background: #4f46e5; color: #fff; border-color: #4f46e5; }
|
|
176
|
-
.toolbar .btn.primary:hover { background: #4338ca; }
|
|
177
|
-
.toolbar .toolbar-label { font-size: 11px; color: #6b7280; }
|
|
178
|
-
/* Table copy controls — one toolbar per table */
|
|
179
|
-
.table-wrap { margin: 8px 0 24px; }
|
|
180
|
-
.table-wrap > table { margin: 0; }
|
|
181
|
-
.table-actions { display: flex; justify-content: flex-end; gap: 6px; margin-bottom: 4px; }
|
|
182
|
-
.btn-copy { display: inline-flex; align-items: center; gap: 4px; padding: 3px 10px; font-size: 11px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #4b5563; font-family: inherit; transition: all .15s ease; }
|
|
183
|
-
.btn-copy:hover { background: #eef2ff; border-color: #6366f1; color: #4338ca; }
|
|
184
|
-
.btn-copy.flashing-ok { background: #10b981; color: #fff; border-color: #10b981; }
|
|
185
|
-
.btn-copy.flashing-err { background: #dc2626; color: #fff; border-color: #dc2626; }
|
|
186
|
-
.fix-recipe { background: #fff7ed; border: 1px solid #fed7aa; border-left: 4px solid #f97316; padding: 10px 14px; border-radius: 4px; margin: 6px 0; font-size: 12px; }
|
|
187
|
-
.fix-recipe code { display: block; background: #1f2937; color: #f3f4f6; padding: 8px 10px; border-radius: 3px; font-size: 11px; margin-top: 6px; white-space: pre; overflow-x: auto; }
|
|
188
|
-
.fix-recipe .recipe-title { font-weight: 600; margin-bottom: 2px; }
|
|
189
|
-
.fix-recipe .recipe-meta { color: #92400e; }
|
|
190
|
-
td.action { font-size: 11px; max-width: 280px; }
|
|
191
|
-
td.action .pin { font-family: ui-monospace, monospace; background: #f3f4f6; padding: 2px 4px; border-radius: 2px; }
|
|
192
|
-
td.action .update-hint { color: #6b7280; font-size: 10px; margin-top: 2px; }
|
|
193
|
-
tr.cve-row { cursor: pointer; }
|
|
194
|
-
tr.cve-row:hover { background: #eef2ff !important; }
|
|
195
|
-
tr.cve-row.open { background: #e0e7ff !important; }
|
|
196
|
-
tr.cve-row td:first-child::before { content: "▸"; display: inline-block; margin-right: 6px; color: #6b7280; transition: transform .15s ease; }
|
|
197
|
-
tr.cve-row.open td:first-child::before { transform: rotate(90deg); color: #6366f1; }
|
|
198
|
-
tr.detail-row { display: none; }
|
|
199
|
-
tr.detail-row.open { display: table-row; }
|
|
200
|
-
tr.detail-row > td { padding: 0; border-bottom: 2px solid #c7d2fe; background: #f9fafb; }
|
|
201
|
-
.detail-panel { background: #f9fafb; border-left: 4px solid #6366f1; padding: 16px 24px; font-size: 12px; line-height: 1.6; width: 100%; }
|
|
202
|
-
.detail-panel .panel-block { margin: 0; padding: 10px 0; border-bottom: 1px solid #e5e7eb; }
|
|
203
|
-
.detail-panel .panel-block:last-child { border-bottom: none; }
|
|
204
|
-
.detail-panel .panel-block .panel-title { font-size: 11px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; font-weight: 600; margin-bottom: 6px; }
|
|
205
|
-
.detail-panel .panel-block .panel-title .count { color: #9ca3af; text-transform: none; letter-spacing: 0; font-weight: 400; margin-left: 4px; }
|
|
206
|
-
.detail-panel .full-desc { white-space: pre-wrap; color: #1f2937; max-width: 1100px; line-height: 1.55; }
|
|
207
|
-
.detail-panel .cvss-vector { font-family: ui-monospace, monospace; font-size: 11px; background: #1f2937; color: #f3f4f6; padding: 4px 8px; border-radius: 3px; display: inline-block; }
|
|
208
|
-
.detail-panel .ref-group { margin: 6px 0; }
|
|
209
|
-
.detail-panel .ref-group .ref-label { display: inline-block; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; padding: 1px 6px; border-radius: 3px; margin-right: 4px; }
|
|
210
|
-
.detail-panel .ref-group .ref-label.patch { background: #d1fae5; color: #065f46; }
|
|
211
|
-
.detail-panel .ref-group .ref-label.exploit { background: #fee2e2; color: #991b1b; }
|
|
212
|
-
.detail-panel .ref-group .ref-label.advisory { background: #dbeafe; color: #1e40af; }
|
|
213
|
-
.detail-panel .ref-group .ref-label.vendor { background: #ede9fe; color: #5b21b6; }
|
|
214
|
-
.detail-panel .ref-group .ref-label.third-party { background: #fef3c7; color: #92400e; }
|
|
215
|
-
.detail-panel .ref-group .ref-label.mailing { background: #f3f4f6; color: #4b5563; }
|
|
216
|
-
.detail-panel .ref-group .ref-label.fix { background: #d1fae5; color: #065f46; }
|
|
217
|
-
.detail-panel .ref-group .ref-label.web { background: #f3f4f6; color: #6b7280; }
|
|
218
|
-
.detail-panel .ref-group .ref-label.other { background: #f3f4f6; color: #6b7280; }
|
|
219
|
-
.detail-panel .ref-list { margin: 4px 0 8px; padding-left: 18px; max-height: 220px; overflow-y: auto; }
|
|
220
|
-
.detail-panel .ref-list li { font-size: 11px; word-break: break-all; line-height: 1.6; }
|
|
221
|
-
.detail-panel .ref-list a { color: #1d4ed8; text-decoration: none; }
|
|
222
|
-
.detail-panel .ref-list a:hover { text-decoration: underline; }
|
|
223
|
-
.detail-panel .kv { display: flex; gap: 16px; flex-wrap: wrap; }
|
|
224
|
-
.detail-panel .kv > div { min-width: 200px; }
|
|
225
|
-
.detail-panel .kv label { display: block; font-size: 10px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; }
|
|
226
|
-
.detail-panel .kv span { font-family: ui-monospace, monospace; font-size: 12px; }
|
|
227
|
-
.detail-panel .via-list { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; max-height: 200px; overflow-y: auto; }
|
|
228
|
-
.detail-panel .via-list div { padding: 2px 0; }
|
|
229
|
-
</style></head>
|
|
230
|
-
<body>
|
|
231
|
-
<header class="report-header">
|
|
232
|
-
<h1>FAD-Checker Report</h1>
|
|
233
|
-
<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
|
|
234
|
-
<div class="meta">
|
|
235
|
-
Project: <strong>monorepo-mixed</strong> · <code class="path">/mnt/wsl/WipDrive/_libs/fad-checker/test/fixtures/monorepo-mixed</code><br>
|
|
236
|
-
Generated: 2026-06-02T09:07:09.509Z · fad-checker 2.1.1 · CVE data: 2026-06-01T09:36:42.393Z
|
|
237
|
-
</div>
|
|
238
|
-
</header>
|
|
239
|
-
<div class="exec-summary exec-high">
|
|
240
|
-
<div class="exec-head">
|
|
241
|
-
<span class="exec-level">HIGH</span>
|
|
242
|
-
<span class="exec-title">Executive Summary</span>
|
|
243
|
-
<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button><template class="exec-copy-rich"><div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;"><p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — HIGH</p><p style="margin:0 0 8px; color:#4b5563;">23 dependencies scanned</p><ul style="margin:4px 0 0; padding-left:22px;"><li style="margin:2px 0;">3 CVE in production deps (critical=0, high=0, medium=3, low=0)</li><li style="margin:2px 0;">1 end-of-life framework</li><li style="margin:2px 0;">1 obsolete / deprecated lib</li><li style="margin:2px 0;">5 outdated libs</li><li style="margin:2px 0;">1 scan-completeness alert — see chapter 0</li></ul></div></template><textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">EXECUTIVE SUMMARY — HIGH
|
|
244
|
-
23 dependencies scanned
|
|
245
|
-
|
|
246
|
-
- 3 CVE in production deps (critical=0, high=0, medium=3, low=0)
|
|
247
|
-
- 1 end-of-life framework
|
|
248
|
-
- 1 obsolete / deprecated lib
|
|
249
|
-
- 5 outdated libs
|
|
250
|
-
- 1 scan-completeness alert — see chapter 0</textarea>
|
|
251
|
-
</div>
|
|
252
|
-
<div class="exec-meta">23 dependencies scanned</div>
|
|
253
|
-
<ul class="exec-bullets">
|
|
254
|
-
<li><strong>3</strong> CVE in production deps (critical=0, high=0, medium=3, low=0)</li><li><strong>1</strong> end-of-life framework</li><li><strong>1</strong> obsolete / deprecated lib</li><li><strong>5</strong> outdated libs</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
|
|
255
|
-
</ul>
|
|
256
|
-
|
|
257
|
-
</div>
|
|
258
|
-
<div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">3</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">0</div><div class="l">Low</div></div><div class="card"><div class="v">3</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">3</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">1</div><div class="l">EOL</div></div><div class="card"><div class="v">1</div><div class="l">Obsolete</div></div><div class="card"><div class="v">5</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
|
|
259
|
-
<nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (1)</a><a href="#ch5">5. Obsolete (1)</a><a href="#ch6">6. Outdated (5)</a><a href="#ch7">7. Licenses (1)</a><a href="#ch8">8. Fix Recos</a></nav>
|
|
260
|
-
<div class="toolbar">
|
|
261
|
-
<button class="btn" type="button" data-action="expand-all">⊕ Expand all</button>
|
|
262
|
-
<button class="btn" type="button" data-action="collapse-all">⊖ Collapse all</button>
|
|
263
|
-
<button class="btn primary" type="button" data-action="expand-cves">↧ Expand all CVE details</button>
|
|
264
|
-
<button class="btn" type="button" data-action="collapse-cves">↥ Collapse all CVE details</button>
|
|
265
|
-
<span class="toolbar-label">Click a section header or a CVE row to toggle.</span>
|
|
266
|
-
</div>
|
|
267
|
-
|
|
268
|
-
<details class="report-section" open id="ch0">
|
|
269
|
-
<summary><h2>0. Warnings & scan-completeness (1)</h2></summary>
|
|
270
|
-
<div><div class="warnings warnings-chapter"><div class="warn-block warn-no-lockfile">
|
|
271
|
-
<div class="warn-head">⚠️ <strong>JS manifest without lockfile</strong></div>
|
|
272
|
-
<div class="warn-path"><code>packages/no-lock/package.json</code></div>
|
|
273
|
-
<div class="warn-msg">package.json without lockfile — best-effort: 1 pinned dep(s) scanned, 2 range(s) skipped (run "npm install" or "yarn install" for full coverage)</div>
|
|
274
|
-
|
|
275
|
-
</div></div></div>
|
|
276
|
-
</details>
|
|
277
|
-
<details class="report-section" open id="ch1">
|
|
278
|
-
<summary><h2>1. CVE Vulnerabilities — production (3)</h2></summary>
|
|
279
|
-
<div><details class="report-subsection" open>
|
|
280
|
-
<summary><h3>1.a Maven (3)</h3></summary>
|
|
281
|
-
<div><details class="report-subsection" open>
|
|
282
|
-
<summary><h3>1.a.0 All (3)</h3></summary>
|
|
283
|
-
<div><details class="report-subsection" open>
|
|
284
|
-
<summary><h3>All — direct (3)</h3></summary>
|
|
285
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
286
|
-
<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
|
|
287
|
-
<tbody><tr class="cve-row">
|
|
288
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
|
|
289
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
290
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
|
|
291
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
292
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
293
|
-
<td class="published">2025-12-18</td>
|
|
294
|
-
<td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
|
|
295
|
-
<td class="dep">2.25.3</td>
|
|
296
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
297
|
-
|
|
298
|
-
</tr>
|
|
299
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
300
|
-
<div class="panel-title">Description</div>
|
|
301
|
-
<div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
|
|
302
|
-
|
|
303
|
-
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
|
|
304
|
-
|
|
305
|
-
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
|
|
306
|
-
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
|
|
310
|
-
|
|
311
|
-
As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
|
|
312
|
-
</div><div class="panel-block">
|
|
313
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
314
|
-
<div><ul class="cwe-list"><li>
|
|
315
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
316
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
317
|
-
</li><li>
|
|
318
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
319
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
320
|
-
</li></ul></div>
|
|
321
|
-
</div><div class="panel-block">
|
|
322
|
-
<div class="panel-title">Metadata</div>
|
|
323
|
-
<div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
324
|
-
</div><div class="panel-block">
|
|
325
|
-
<div class="panel-title">External links <span class="count">(8)</span></div>
|
|
326
|
-
<div><div class="ref-group">
|
|
327
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
328
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
|
|
329
|
-
</div><div class="ref-group">
|
|
330
|
-
<span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
331
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
|
|
332
|
-
</div><div class="ref-group">
|
|
333
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
334
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
|
|
335
|
-
</div><div class="ref-group">
|
|
336
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
|
|
337
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
|
|
338
|
-
</div><div class="ref-group">
|
|
339
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
340
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
|
|
341
|
-
</div></div>
|
|
342
|
-
</div><div class="panel-block">
|
|
343
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
|
|
344
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
|
|
345
|
-
</div><div class="panel-block">
|
|
346
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
347
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
348
|
-
</div></div></td></tr>
|
|
349
|
-
<tr class="cve-row">
|
|
350
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
|
|
351
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
|
|
352
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
|
|
353
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
354
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
|
|
355
|
-
<td class="published">2026-04-10</td>
|
|
356
|
-
<td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
|
|
357
|
-
<td class="dep">2.25.4</td>
|
|
358
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
359
|
-
|
|
360
|
-
</tr>
|
|
361
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
362
|
-
<div class="panel-title">Description</div>
|
|
363
|
-
<div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
|
|
364
|
-
|
|
365
|
-
The impact depends on the StAX implementation in use:
|
|
366
|
-
|
|
367
|
-
* JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
|
|
368
|
-
* Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
|
|
369
|
-
|
|
370
|
-
|
|
371
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
|
|
372
|
-
</div><div class="panel-block">
|
|
373
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
|
|
374
|
-
<div><ul class="cwe-list"><li>
|
|
375
|
-
<a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
|
|
376
|
-
<span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
|
|
377
|
-
</li></ul></div>
|
|
378
|
-
</div><div class="panel-block">
|
|
379
|
-
<div class="panel-title">Metadata</div>
|
|
380
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
381
|
-
</div><div class="panel-block">
|
|
382
|
-
<div class="panel-title">External links <span class="count">(6)</span></div>
|
|
383
|
-
<div><div class="ref-group">
|
|
384
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
385
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
|
|
386
|
-
</div><div class="ref-group">
|
|
387
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
388
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
|
|
389
|
-
</div><div class="ref-group">
|
|
390
|
-
<span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
391
|
-
<ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
|
|
392
|
-
</div><div class="ref-group">
|
|
393
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
394
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
|
|
395
|
-
</div></div>
|
|
396
|
-
</div><div class="panel-block">
|
|
397
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
398
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
399
|
-
</div><div class="panel-block">
|
|
400
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
401
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
402
|
-
</div></div></td></tr>
|
|
403
|
-
<tr class="cve-row">
|
|
404
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
|
|
405
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
406
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
|
|
407
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
408
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
409
|
-
<td class="published">2026-04-10</td>
|
|
410
|
-
<td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
|
|
411
|
-
<td class="dep">2.25.4</td>
|
|
412
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
413
|
-
|
|
414
|
-
</tr>
|
|
415
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
416
|
-
<div class="panel-title">Description</div>
|
|
417
|
-
<div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
|
|
418
|
-
|
|
419
|
-
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
|
|
420
|
-
|
|
421
|
-
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
|
|
422
|
-
|
|
423
|
-
* An SMTP, Socket, or Syslog appender is in use.
|
|
424
|
-
* TLS is configured via a nested <Ssl> element.
|
|
425
|
-
* The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
|
|
426
|
-
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
|
|
427
|
-
|
|
428
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
|
|
429
|
-
</div><div class="panel-block">
|
|
430
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
431
|
-
<div><ul class="cwe-list"><li>
|
|
432
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
433
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
434
|
-
</li><li>
|
|
435
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
436
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
437
|
-
</li></ul></div>
|
|
438
|
-
</div><div class="panel-block">
|
|
439
|
-
<div class="panel-title">Metadata</div>
|
|
440
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
441
|
-
</div><div class="panel-block">
|
|
442
|
-
<div class="panel-title">External links <span class="count">(5)</span></div>
|
|
443
|
-
<div><div class="ref-group">
|
|
444
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
445
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
|
|
446
|
-
</div><div class="ref-group">
|
|
447
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
448
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
|
|
449
|
-
</div><div class="ref-group">
|
|
450
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
451
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
|
|
452
|
-
</div><div class="ref-group">
|
|
453
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
454
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
|
|
455
|
-
</div></div>
|
|
456
|
-
</div><div class="panel-block">
|
|
457
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
458
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
459
|
-
</div><div class="panel-block">
|
|
460
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
461
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
462
|
-
</div></div></td></tr></tbody>
|
|
463
|
-
</table></div></div>
|
|
464
|
-
</details><details class="report-subsection" open>
|
|
465
|
-
<summary><h3>All — transitive (0)</h3></summary>
|
|
466
|
-
<div><div class="empty">No CVEs matched.</div></div>
|
|
467
|
-
</details></div>
|
|
468
|
-
</details><details class="report-subsection">
|
|
469
|
-
<summary><h3>By pom.xml (3 files)</h3></summary>
|
|
470
|
-
<div><details class="report-subsection" open>
|
|
471
|
-
<summary><h3><code class="path">libs/common-bom/pom.xml</code> (3)</h3></summary>
|
|
472
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
473
|
-
<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
|
|
474
|
-
<tbody><tr class="cve-row">
|
|
475
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
|
|
476
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
477
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
|
|
478
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
479
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
480
|
-
<td class="published">2025-12-18</td>
|
|
481
|
-
<td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
|
|
482
|
-
<td class="dep">2.25.3</td>
|
|
483
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
484
|
-
|
|
485
|
-
</tr>
|
|
486
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
487
|
-
<div class="panel-title">Description</div>
|
|
488
|
-
<div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
|
|
489
|
-
|
|
490
|
-
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
|
|
491
|
-
|
|
492
|
-
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
|
|
493
|
-
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
|
|
494
|
-
|
|
495
|
-
|
|
496
|
-
Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
|
|
497
|
-
|
|
498
|
-
As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
|
|
499
|
-
</div><div class="panel-block">
|
|
500
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
501
|
-
<div><ul class="cwe-list"><li>
|
|
502
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
503
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
504
|
-
</li><li>
|
|
505
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
506
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
507
|
-
</li></ul></div>
|
|
508
|
-
</div><div class="panel-block">
|
|
509
|
-
<div class="panel-title">Metadata</div>
|
|
510
|
-
<div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
511
|
-
</div><div class="panel-block">
|
|
512
|
-
<div class="panel-title">External links <span class="count">(8)</span></div>
|
|
513
|
-
<div><div class="ref-group">
|
|
514
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
515
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
|
|
516
|
-
</div><div class="ref-group">
|
|
517
|
-
<span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
518
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
|
|
519
|
-
</div><div class="ref-group">
|
|
520
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
521
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
|
|
522
|
-
</div><div class="ref-group">
|
|
523
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
|
|
524
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
|
|
525
|
-
</div><div class="ref-group">
|
|
526
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
527
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
|
|
528
|
-
</div></div>
|
|
529
|
-
</div><div class="panel-block">
|
|
530
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
|
|
531
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
|
|
532
|
-
</div><div class="panel-block">
|
|
533
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
534
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
535
|
-
</div></div></td></tr>
|
|
536
|
-
<tr class="cve-row">
|
|
537
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
|
|
538
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
|
|
539
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
|
|
540
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
541
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
|
|
542
|
-
<td class="published">2026-04-10</td>
|
|
543
|
-
<td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
|
|
544
|
-
<td class="dep">2.25.4</td>
|
|
545
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
546
|
-
|
|
547
|
-
</tr>
|
|
548
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
549
|
-
<div class="panel-title">Description</div>
|
|
550
|
-
<div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
|
|
551
|
-
|
|
552
|
-
The impact depends on the StAX implementation in use:
|
|
553
|
-
|
|
554
|
-
* JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
|
|
555
|
-
* Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
|
|
559
|
-
</div><div class="panel-block">
|
|
560
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
|
|
561
|
-
<div><ul class="cwe-list"><li>
|
|
562
|
-
<a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
|
|
563
|
-
<span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
|
|
564
|
-
</li></ul></div>
|
|
565
|
-
</div><div class="panel-block">
|
|
566
|
-
<div class="panel-title">Metadata</div>
|
|
567
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
568
|
-
</div><div class="panel-block">
|
|
569
|
-
<div class="panel-title">External links <span class="count">(6)</span></div>
|
|
570
|
-
<div><div class="ref-group">
|
|
571
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
572
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
|
|
573
|
-
</div><div class="ref-group">
|
|
574
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
575
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
|
|
576
|
-
</div><div class="ref-group">
|
|
577
|
-
<span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
578
|
-
<ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
|
|
579
|
-
</div><div class="ref-group">
|
|
580
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
581
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
|
|
582
|
-
</div></div>
|
|
583
|
-
</div><div class="panel-block">
|
|
584
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
585
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
586
|
-
</div><div class="panel-block">
|
|
587
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
588
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
589
|
-
</div></div></td></tr>
|
|
590
|
-
<tr class="cve-row">
|
|
591
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
|
|
592
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
593
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
|
|
594
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
595
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
596
|
-
<td class="published">2026-04-10</td>
|
|
597
|
-
<td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
|
|
598
|
-
<td class="dep">2.25.4</td>
|
|
599
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
600
|
-
|
|
601
|
-
</tr>
|
|
602
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
603
|
-
<div class="panel-title">Description</div>
|
|
604
|
-
<div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
|
|
605
|
-
|
|
606
|
-
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
|
|
607
|
-
|
|
608
|
-
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
|
|
609
|
-
|
|
610
|
-
* An SMTP, Socket, or Syslog appender is in use.
|
|
611
|
-
* TLS is configured via a nested <Ssl> element.
|
|
612
|
-
* The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
|
|
613
|
-
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
|
|
614
|
-
|
|
615
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
|
|
616
|
-
</div><div class="panel-block">
|
|
617
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
618
|
-
<div><ul class="cwe-list"><li>
|
|
619
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
620
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
621
|
-
</li><li>
|
|
622
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
623
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
624
|
-
</li></ul></div>
|
|
625
|
-
</div><div class="panel-block">
|
|
626
|
-
<div class="panel-title">Metadata</div>
|
|
627
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
628
|
-
</div><div class="panel-block">
|
|
629
|
-
<div class="panel-title">External links <span class="count">(5)</span></div>
|
|
630
|
-
<div><div class="ref-group">
|
|
631
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
632
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
|
|
633
|
-
</div><div class="ref-group">
|
|
634
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
635
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
|
|
636
|
-
</div><div class="ref-group">
|
|
637
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
638
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
|
|
639
|
-
</div><div class="ref-group">
|
|
640
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
641
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
|
|
642
|
-
</div></div>
|
|
643
|
-
</div><div class="panel-block">
|
|
644
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
645
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
646
|
-
</div><div class="panel-block">
|
|
647
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
648
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
649
|
-
</div></div></td></tr></tbody>
|
|
650
|
-
</table></div></div>
|
|
651
|
-
</details><details class="report-subsection" open>
|
|
652
|
-
<summary><h3><code class="path">pom.xml</code> (3)</h3></summary>
|
|
653
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
654
|
-
<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
|
|
655
|
-
<tbody><tr class="cve-row">
|
|
656
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
|
|
657
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
658
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
|
|
659
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
660
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
661
|
-
<td class="published">2025-12-18</td>
|
|
662
|
-
<td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
|
|
663
|
-
<td class="dep">2.25.3</td>
|
|
664
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
665
|
-
|
|
666
|
-
</tr>
|
|
667
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
668
|
-
<div class="panel-title">Description</div>
|
|
669
|
-
<div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
|
|
670
|
-
|
|
671
|
-
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
|
|
672
|
-
|
|
673
|
-
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
|
|
674
|
-
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
|
|
675
|
-
|
|
676
|
-
|
|
677
|
-
Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
|
|
678
|
-
|
|
679
|
-
As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
|
|
680
|
-
</div><div class="panel-block">
|
|
681
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
682
|
-
<div><ul class="cwe-list"><li>
|
|
683
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
684
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
685
|
-
</li><li>
|
|
686
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
687
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
688
|
-
</li></ul></div>
|
|
689
|
-
</div><div class="panel-block">
|
|
690
|
-
<div class="panel-title">Metadata</div>
|
|
691
|
-
<div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
692
|
-
</div><div class="panel-block">
|
|
693
|
-
<div class="panel-title">External links <span class="count">(8)</span></div>
|
|
694
|
-
<div><div class="ref-group">
|
|
695
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
696
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
|
|
697
|
-
</div><div class="ref-group">
|
|
698
|
-
<span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
699
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
|
|
700
|
-
</div><div class="ref-group">
|
|
701
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
702
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
|
|
703
|
-
</div><div class="ref-group">
|
|
704
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
|
|
705
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
|
|
706
|
-
</div><div class="ref-group">
|
|
707
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
708
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
|
|
709
|
-
</div></div>
|
|
710
|
-
</div><div class="panel-block">
|
|
711
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
|
|
712
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
|
|
713
|
-
</div><div class="panel-block">
|
|
714
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
715
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
716
|
-
</div></div></td></tr>
|
|
717
|
-
<tr class="cve-row">
|
|
718
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
|
|
719
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
|
|
720
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
|
|
721
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
722
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
|
|
723
|
-
<td class="published">2026-04-10</td>
|
|
724
|
-
<td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
|
|
725
|
-
<td class="dep">2.25.4</td>
|
|
726
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
727
|
-
|
|
728
|
-
</tr>
|
|
729
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
730
|
-
<div class="panel-title">Description</div>
|
|
731
|
-
<div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
|
|
732
|
-
|
|
733
|
-
The impact depends on the StAX implementation in use:
|
|
734
|
-
|
|
735
|
-
* JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
|
|
736
|
-
* Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
|
|
737
|
-
|
|
738
|
-
|
|
739
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
|
|
740
|
-
</div><div class="panel-block">
|
|
741
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
|
|
742
|
-
<div><ul class="cwe-list"><li>
|
|
743
|
-
<a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
|
|
744
|
-
<span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
|
|
745
|
-
</li></ul></div>
|
|
746
|
-
</div><div class="panel-block">
|
|
747
|
-
<div class="panel-title">Metadata</div>
|
|
748
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
749
|
-
</div><div class="panel-block">
|
|
750
|
-
<div class="panel-title">External links <span class="count">(6)</span></div>
|
|
751
|
-
<div><div class="ref-group">
|
|
752
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
753
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
|
|
754
|
-
</div><div class="ref-group">
|
|
755
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
756
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
|
|
757
|
-
</div><div class="ref-group">
|
|
758
|
-
<span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
759
|
-
<ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
|
|
760
|
-
</div><div class="ref-group">
|
|
761
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
762
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
|
|
763
|
-
</div></div>
|
|
764
|
-
</div><div class="panel-block">
|
|
765
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
766
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
767
|
-
</div><div class="panel-block">
|
|
768
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
769
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
770
|
-
</div></div></td></tr>
|
|
771
|
-
<tr class="cve-row">
|
|
772
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
|
|
773
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
774
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
|
|
775
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
776
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
777
|
-
<td class="published">2026-04-10</td>
|
|
778
|
-
<td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
|
|
779
|
-
<td class="dep">2.25.4</td>
|
|
780
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
781
|
-
|
|
782
|
-
</tr>
|
|
783
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
784
|
-
<div class="panel-title">Description</div>
|
|
785
|
-
<div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
|
|
786
|
-
|
|
787
|
-
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
|
|
788
|
-
|
|
789
|
-
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
|
|
790
|
-
|
|
791
|
-
* An SMTP, Socket, or Syslog appender is in use.
|
|
792
|
-
* TLS is configured via a nested <Ssl> element.
|
|
793
|
-
* The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
|
|
794
|
-
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
|
|
795
|
-
|
|
796
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
|
|
797
|
-
</div><div class="panel-block">
|
|
798
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
799
|
-
<div><ul class="cwe-list"><li>
|
|
800
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
801
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
802
|
-
</li><li>
|
|
803
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
804
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
805
|
-
</li></ul></div>
|
|
806
|
-
</div><div class="panel-block">
|
|
807
|
-
<div class="panel-title">Metadata</div>
|
|
808
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
809
|
-
</div><div class="panel-block">
|
|
810
|
-
<div class="panel-title">External links <span class="count">(5)</span></div>
|
|
811
|
-
<div><div class="ref-group">
|
|
812
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
813
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
|
|
814
|
-
</div><div class="ref-group">
|
|
815
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
816
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
|
|
817
|
-
</div><div class="ref-group">
|
|
818
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
819
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
|
|
820
|
-
</div><div class="ref-group">
|
|
821
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
822
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
|
|
823
|
-
</div></div>
|
|
824
|
-
</div><div class="panel-block">
|
|
825
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
826
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
827
|
-
</div><div class="panel-block">
|
|
828
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
829
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
830
|
-
</div></div></td></tr></tbody>
|
|
831
|
-
</table></div></div>
|
|
832
|
-
</details><details class="report-subsection" open>
|
|
833
|
-
<summary><h3><code class="path">services/worker/pom.xml</code> (3)</h3></summary>
|
|
834
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
835
|
-
<thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
|
|
836
|
-
<tbody><tr class="cve-row">
|
|
837
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
|
|
838
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
839
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
|
|
840
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
841
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
842
|
-
<td class="published">2025-12-18</td>
|
|
843
|
-
<td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
|
|
844
|
-
<td class="dep">2.25.3</td>
|
|
845
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
846
|
-
|
|
847
|
-
</tr>
|
|
848
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
849
|
-
<div class="panel-title">Description</div>
|
|
850
|
-
<div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
|
|
851
|
-
|
|
852
|
-
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
|
|
853
|
-
|
|
854
|
-
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
|
|
855
|
-
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
|
|
856
|
-
|
|
857
|
-
|
|
858
|
-
Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
|
|
859
|
-
|
|
860
|
-
As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
|
|
861
|
-
</div><div class="panel-block">
|
|
862
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
863
|
-
<div><ul class="cwe-list"><li>
|
|
864
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
865
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
866
|
-
</li><li>
|
|
867
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
868
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
869
|
-
</li></ul></div>
|
|
870
|
-
</div><div class="panel-block">
|
|
871
|
-
<div class="panel-title">Metadata</div>
|
|
872
|
-
<div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
873
|
-
</div><div class="panel-block">
|
|
874
|
-
<div class="panel-title">External links <span class="count">(8)</span></div>
|
|
875
|
-
<div><div class="ref-group">
|
|
876
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
877
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
|
|
878
|
-
</div><div class="ref-group">
|
|
879
|
-
<span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
880
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
|
|
881
|
-
</div><div class="ref-group">
|
|
882
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
883
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
|
|
884
|
-
</div><div class="ref-group">
|
|
885
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
|
|
886
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
|
|
887
|
-
</div><div class="ref-group">
|
|
888
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
889
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
|
|
890
|
-
</div></div>
|
|
891
|
-
</div><div class="panel-block">
|
|
892
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
|
|
893
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
|
|
894
|
-
</div><div class="panel-block">
|
|
895
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
896
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
897
|
-
</div></div></td></tr>
|
|
898
|
-
<tr class="cve-row">
|
|
899
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
|
|
900
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
|
|
901
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
|
|
902
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
903
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
|
|
904
|
-
<td class="published">2026-04-10</td>
|
|
905
|
-
<td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
|
|
906
|
-
<td class="dep">2.25.4</td>
|
|
907
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
908
|
-
|
|
909
|
-
</tr>
|
|
910
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
911
|
-
<div class="panel-title">Description</div>
|
|
912
|
-
<div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
|
|
913
|
-
|
|
914
|
-
The impact depends on the StAX implementation in use:
|
|
915
|
-
|
|
916
|
-
* JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
|
|
917
|
-
* Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
|
|
918
|
-
|
|
919
|
-
|
|
920
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
|
|
921
|
-
</div><div class="panel-block">
|
|
922
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
|
|
923
|
-
<div><ul class="cwe-list"><li>
|
|
924
|
-
<a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
|
|
925
|
-
<span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
|
|
926
|
-
</li></ul></div>
|
|
927
|
-
</div><div class="panel-block">
|
|
928
|
-
<div class="panel-title">Metadata</div>
|
|
929
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
930
|
-
</div><div class="panel-block">
|
|
931
|
-
<div class="panel-title">External links <span class="count">(6)</span></div>
|
|
932
|
-
<div><div class="ref-group">
|
|
933
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
934
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
|
|
935
|
-
</div><div class="ref-group">
|
|
936
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
937
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
|
|
938
|
-
</div><div class="ref-group">
|
|
939
|
-
<span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
940
|
-
<ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
|
|
941
|
-
</div><div class="ref-group">
|
|
942
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
943
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
|
|
944
|
-
</div></div>
|
|
945
|
-
</div><div class="panel-block">
|
|
946
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
947
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
948
|
-
</div><div class="panel-block">
|
|
949
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
950
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
951
|
-
</div></div></td></tr>
|
|
952
|
-
<tr class="cve-row">
|
|
953
|
-
<td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
|
|
954
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
|
|
955
|
-
<td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
|
|
956
|
-
<td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
957
|
-
<td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
|
|
958
|
-
<td class="published">2026-04-10</td>
|
|
959
|
-
<td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
|
|
960
|
-
<td class="dep">2.25.4</td>
|
|
961
|
-
<td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
|
|
962
|
-
|
|
963
|
-
</tr>
|
|
964
|
-
<tr class="detail-row"><td colspan="9"><div class="detail-panel"><div class="panel-block">
|
|
965
|
-
<div class="panel-title">Description</div>
|
|
966
|
-
<div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
|
|
967
|
-
|
|
968
|
-
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
|
|
969
|
-
|
|
970
|
-
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
|
|
971
|
-
|
|
972
|
-
* An SMTP, Socket, or Syslog appender is in use.
|
|
973
|
-
* TLS is configured via a nested <Ssl> element.
|
|
974
|
-
* The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
|
|
975
|
-
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
|
|
976
|
-
|
|
977
|
-
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
|
|
978
|
-
</div><div class="panel-block">
|
|
979
|
-
<div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
|
|
980
|
-
<div><ul class="cwe-list"><li>
|
|
981
|
-
<a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
|
|
982
|
-
<span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
|
|
983
|
-
</li><li>
|
|
984
|
-
<a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
|
|
985
|
-
<span class="cwe-name-inline">— Improper Certificate Validation</span>
|
|
986
|
-
</li></ul></div>
|
|
987
|
-
</div><div class="panel-block">
|
|
988
|
-
<div class="panel-title">Metadata</div>
|
|
989
|
-
<div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
|
|
990
|
-
</div><div class="panel-block">
|
|
991
|
-
<div class="panel-title">External links <span class="count">(5)</span></div>
|
|
992
|
-
<div><div class="ref-group">
|
|
993
|
-
<span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
994
|
-
<ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
|
|
995
|
-
</div><div class="ref-group">
|
|
996
|
-
<span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
|
|
997
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
|
|
998
|
-
</div><div class="ref-group">
|
|
999
|
-
<span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
1000
|
-
<ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
|
|
1001
|
-
</div><div class="ref-group">
|
|
1002
|
-
<span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
|
|
1003
|
-
<ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
|
|
1004
|
-
</div></div>
|
|
1005
|
-
</div><div class="panel-block">
|
|
1006
|
-
<div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
|
|
1007
|
-
<div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
|
|
1008
|
-
</div><div class="panel-block">
|
|
1009
|
-
<div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
|
|
1010
|
-
<div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
|
|
1011
|
-
</div></div></td></tr></tbody>
|
|
1012
|
-
</table></div></div>
|
|
1013
|
-
</details></div>
|
|
1014
|
-
</details></div>
|
|
1015
|
-
</details></div>
|
|
1016
|
-
</details>
|
|
1017
|
-
|
|
1018
|
-
<details class="report-section" id="ch2">
|
|
1019
|
-
<summary><h2>2. Vendored JS scan — retire.js (0)</h2></summary>
|
|
1020
|
-
<div><div class="empty">No vulnerable vendored JavaScript files detected (or retire.js was skipped).</div></div>
|
|
1021
|
-
</details>
|
|
1022
|
-
<details class="report-section" id="ch3">
|
|
1023
|
-
<summary><h2>3. CVE in dev dependencies (0)</h2></summary>
|
|
1024
|
-
<div><div class="empty">No CVE matches.</div></div>
|
|
1025
|
-
</details>
|
|
1026
|
-
<details class="report-section" open id="ch4">
|
|
1027
|
-
<summary><h2>4. End-of-Life Frameworks (1)</h2></summary>
|
|
1028
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
1029
|
-
<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
|
|
1030
|
-
<tbody><tr>
|
|
1031
|
-
<td class="dep">Spring Framework</td>
|
|
1032
|
-
<td class="dep">org.springframework:spring-web<br><span style="color:#6b7280">5.3.20</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/api/pom.xml</code></div></td>
|
|
1033
|
-
<td>2024-08-31</td>
|
|
1034
|
-
<td>5.3.39</td>
|
|
1035
|
-
<td class="desc">Latest: 5.3.39 (2024-08-14)</td>
|
|
1036
|
-
</tr></tbody>
|
|
1037
|
-
</table></div></div>
|
|
1038
|
-
</details>
|
|
1039
|
-
<details class="report-section" open id="ch5">
|
|
1040
|
-
<summary><h2>5. Obsolete / Deprecated Libraries (1)</h2></summary>
|
|
1041
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
1042
|
-
<thead><tr><th>Severity</th><th>Obsolete</th><th>Replacement</th><th>Why</th></tr></thead>
|
|
1043
|
-
<tbody><tr>
|
|
1044
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span></td>
|
|
1045
|
-
<td class="dep">junit:junit<br><span style="color:#6b7280">4.12</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
|
|
1046
|
-
<td class="dep">org.junit.jupiter:junit-jupiter (JUnit 5)</td>
|
|
1047
|
-
<td class="desc">JUnit 4 is in maintenance; JUnit 5 is the modern line.</td>
|
|
1048
|
-
</tr></tbody>
|
|
1049
|
-
</table></div></div>
|
|
1050
|
-
</details>
|
|
1051
|
-
<details class="report-section" open id="ch6">
|
|
1052
|
-
<summary><h2>6. Outdated Libraries (5)</h2></summary>
|
|
1053
|
-
<div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
1054
|
-
<thead><tr><th>Jump</th><th>Dependency</th><th>Current</th><th>Latest</th><th>Released</th></tr></thead>
|
|
1055
|
-
<tbody><tr class="jump-major">
|
|
1056
|
-
<td><span class="jump-badge jump-major">+1 major</span></td>
|
|
1057
|
-
<td class="dep">npm:chalk<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
|
|
1058
|
-
<td class="dep">4.1.2</td>
|
|
1059
|
-
<td class="dep">5.6.2</td>
|
|
1060
|
-
<td>2025-09-08</td>
|
|
1061
|
-
</tr>
|
|
1062
|
-
<tr class="jump-major">
|
|
1063
|
-
<td><span class="jump-badge jump-major">+3 major</span></td>
|
|
1064
|
-
<td class="dep">npm:supports-color<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
|
|
1065
|
-
<td class="dep">7.2.0</td>
|
|
1066
|
-
<td class="dep">10.2.2</td>
|
|
1067
|
-
<td>2025-09-08</td>
|
|
1068
|
-
</tr>
|
|
1069
|
-
<tr class="jump-major">
|
|
1070
|
-
<td><span class="jump-badge jump-major">+1 major</span></td>
|
|
1071
|
-
<td class="dep">org.yaml:snakeyaml<div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
|
|
1072
|
-
<td class="dep">1.30</td>
|
|
1073
|
-
<td class="dep">2.4</td>
|
|
1074
|
-
<td>2025-02-15</td>
|
|
1075
|
-
</tr>
|
|
1076
|
-
<tr class="jump-minor">
|
|
1077
|
-
<td><span class="jump-badge jump-minor">+9 minor</span></td>
|
|
1078
|
-
<td class="dep">com.fasterxml.jackson.core:jackson-databind<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/api/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
1079
|
-
<td class="dep">2.9.10</td>
|
|
1080
|
-
<td class="dep">2.18.4</td>
|
|
1081
|
-
<td>2025-05-07</td>
|
|
1082
|
-
</tr>
|
|
1083
|
-
<tr class="jump-minor">
|
|
1084
|
-
<td><span class="jump-badge jump-minor">+12 minor</span></td>
|
|
1085
|
-
<td class="dep">org.apache.logging.log4j:log4j-core<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
|
|
1086
|
-
<td class="dep">2.14.0</td>
|
|
1087
|
-
<td class="dep">2.26.0</td>
|
|
1088
|
-
<td>2026-05-02</td>
|
|
1089
|
-
</tr></tbody>
|
|
1090
|
-
</table></div></div>
|
|
1091
|
-
</details>
|
|
1092
|
-
<details class="report-section" id="ch7">
|
|
1093
|
-
<summary><h2>7. Licenses (1)</h2></summary>
|
|
1094
|
-
<div><div class="fp-intro">All resolved licenses are permissive. Listed for completeness.</div><div class="lic-group lic-ok">
|
|
1095
|
-
<h3 class="lic-h">Permissive (MIT/Apache/BSD) <span class="lic-n">1</span></h3>
|
|
1096
|
-
<div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table><thead><tr><th>Dependency</th><th>License(s)</th><th>Source</th></tr></thead><tbody><tr>
|
|
1097
|
-
<td><td class="dep">npm:<br>supports-color<br><span style="color:#6b7280">7.2.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td></td>
|
|
1098
|
-
<td>MIT</td>
|
|
1099
|
-
<td>npm</td>
|
|
1100
|
-
</tr></tbody></table></div>
|
|
1101
|
-
</div></div>
|
|
1102
|
-
</details>
|
|
1103
|
-
<details class="report-section" id="ch8">
|
|
1104
|
-
<summary><h2>8. Fix Recommendations</h2></summary>
|
|
1105
|
-
<div><details class="report-subsection" open>
|
|
1106
|
-
<summary><h3>7.0 Direct deps to update (1)</h3></summary>
|
|
1107
|
-
<div><div class="fp-intro">Every direct dep with at least one CVE matched. The "Pin to ≥" column shows the highest fix-version declared across the CVEs for that dep. When that's missing, the dep needs a manual triage (no clean fix is published).</div><div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div><table>
|
|
1108
|
-
<thead><tr><th>Worst sev</th><th>Direct dependency</th><th>Current</th><th>Pin to ≥</th><th>Maven Central latest</th><th>CVEs covered</th></tr></thead>
|
|
1109
|
-
<tbody><tr>
|
|
1110
|
-
<td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span></td>
|
|
1111
|
-
<td class="dep">org.apache.logging.log4j:log4j-core</td>
|
|
1112
|
-
<td class="dep">2.14.0</td>
|
|
1113
|
-
<td class="dep"><span style="color:#065f46;font-weight:600">2.25.4</span></td>
|
|
1114
|
-
<td class="dep">2.26.0</td>
|
|
1115
|
-
<td class="confidence">3 CVE: CVE-2025-68161, CVE-2026-34477, CVE-2026-34480</td>
|
|
1116
|
-
</tr></tbody>
|
|
1117
|
-
</table></div></div>
|
|
1118
|
-
</details></div>
|
|
1119
|
-
</details>
|
|
1120
|
-
|
|
1121
|
-
|
|
1122
|
-
<script>
|
|
1123
|
-
(function(){
|
|
1124
|
-
function isInteractive(el){
|
|
1125
|
-
if(!el) return false;
|
|
1126
|
-
var t = el.tagName;
|
|
1127
|
-
return t === 'A' || t === 'BUTTON' || t === 'INPUT' || t === 'SUMMARY' || t === 'DETAILS' || t === 'LABEL';
|
|
1128
|
-
}
|
|
1129
|
-
// CVE row click → toggle its detail panel
|
|
1130
|
-
document.querySelectorAll('tr.cve-row').forEach(function(row){
|
|
1131
|
-
row.addEventListener('click', function(e){
|
|
1132
|
-
var t = e.target;
|
|
1133
|
-
while(t && t !== row){
|
|
1134
|
-
if(isInteractive(t)) return;
|
|
1135
|
-
t = t.parentNode;
|
|
1136
|
-
}
|
|
1137
|
-
var next = row.nextElementSibling;
|
|
1138
|
-
if(next && next.classList.contains('detail-row')){
|
|
1139
|
-
var nowOpen = next.classList.toggle('open');
|
|
1140
|
-
row.classList.toggle('open', nowOpen);
|
|
1141
|
-
}
|
|
1142
|
-
});
|
|
1143
|
-
});
|
|
1144
|
-
// Toolbar buttons
|
|
1145
|
-
document.querySelectorAll('.toolbar .btn').forEach(function(btn){
|
|
1146
|
-
btn.addEventListener('click', function(){
|
|
1147
|
-
var action = btn.getAttribute('data-action');
|
|
1148
|
-
if(action === 'expand-all'){
|
|
1149
|
-
document.querySelectorAll('details').forEach(function(d){ d.open = true; });
|
|
1150
|
-
document.querySelectorAll('tr.cve-row').forEach(function(r){
|
|
1151
|
-
r.classList.add('open');
|
|
1152
|
-
var n = r.nextElementSibling;
|
|
1153
|
-
if(n && n.classList.contains('detail-row')) n.classList.add('open');
|
|
1154
|
-
});
|
|
1155
|
-
} else if(action === 'collapse-all'){
|
|
1156
|
-
document.querySelectorAll('details').forEach(function(d){ d.open = false; });
|
|
1157
|
-
document.querySelectorAll('tr.cve-row.open').forEach(function(r){ r.classList.remove('open'); });
|
|
1158
|
-
document.querySelectorAll('tr.detail-row.open').forEach(function(r){ r.classList.remove('open'); });
|
|
1159
|
-
} else if(action === 'expand-cves'){
|
|
1160
|
-
document.querySelectorAll('tr.cve-row').forEach(function(r){
|
|
1161
|
-
r.classList.add('open');
|
|
1162
|
-
var n = r.nextElementSibling;
|
|
1163
|
-
if(n && n.classList.contains('detail-row')) n.classList.add('open');
|
|
1164
|
-
});
|
|
1165
|
-
} else if(action === 'collapse-cves'){
|
|
1166
|
-
document.querySelectorAll('tr.cve-row.open').forEach(function(r){ r.classList.remove('open'); });
|
|
1167
|
-
document.querySelectorAll('tr.detail-row.open').forEach(function(r){ r.classList.remove('open'); });
|
|
1168
|
-
}
|
|
1169
|
-
});
|
|
1170
|
-
});
|
|
1171
|
-
})();
|
|
1172
|
-
</script>
|
|
1173
|
-
<script>
|
|
1174
|
-
(function(){
|
|
1175
|
-
// Inline styles applied to clipboard-bound table so it survives pasting into
|
|
1176
|
-
// Word with reasonable formatting (Word ignores most external CSS classes,
|
|
1177
|
-
// but honours inline style="…" attributes).
|
|
1178
|
-
function inlineStylesForWord(table){
|
|
1179
|
-
var clone = table.cloneNode(true);
|
|
1180
|
-
// Drop expandable detail rows (they would paste as huge empty cells)
|
|
1181
|
-
clone.querySelectorAll('tr.detail-row').forEach(function(r){ r.remove(); });
|
|
1182
|
-
// Strip our interactive classes so Word doesn't try to interpret them
|
|
1183
|
-
clone.querySelectorAll('tr.cve-row').forEach(function(r){
|
|
1184
|
-
r.classList.remove('cve-row');
|
|
1185
|
-
r.classList.remove('open');
|
|
1186
|
-
r.classList.remove('cpe-fp');
|
|
1187
|
-
});
|
|
1188
|
-
clone.setAttribute('border', '1');
|
|
1189
|
-
clone.setAttribute('cellspacing', '0');
|
|
1190
|
-
clone.setAttribute('cellpadding', '6');
|
|
1191
|
-
clone.setAttribute('width', '100%');
|
|
1192
|
-
clone.setAttribute('style', 'width:100%; border-collapse:collapse; font-family:Calibri,Arial,sans-serif; font-size:10pt; color:#1f2937;');
|
|
1193
|
-
clone.querySelectorAll('th').forEach(function(th){
|
|
1194
|
-
th.setAttribute('style', 'background:#f3f4f6; padding:6px 8px; border:1px solid #d1d5db; text-align:left; font-weight:bold; font-size:9pt; text-transform:uppercase; letter-spacing:.5px; color:#4b5563;');
|
|
1195
|
-
});
|
|
1196
|
-
clone.querySelectorAll('td').forEach(function(td){
|
|
1197
|
-
var prev = td.getAttribute('style') || '';
|
|
1198
|
-
td.setAttribute('style', 'padding:6px 8px; border:1px solid #e5e7eb; vertical-align:top; ' + prev);
|
|
1199
|
-
});
|
|
1200
|
-
// Replace severity badges with plain coloured text so they survive paste
|
|
1201
|
-
clone.querySelectorAll('span[style*="border-radius"]').forEach(function(s){
|
|
1202
|
-
var m = (s.getAttribute('style') || '').match(/background:\s*(#[0-9a-fA-F]{3,6})/);
|
|
1203
|
-
var bg = m ? m[1] : '#666';
|
|
1204
|
-
s.setAttribute('style', 'background:' + bg + '; color:#fff; padding:2px 6px; font-weight:bold; font-size:9pt;');
|
|
1205
|
-
});
|
|
1206
|
-
return clone;
|
|
1207
|
-
}
|
|
1208
|
-
function wordWrapper(tableHtml){
|
|
1209
|
-
return '<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"><head><meta charset="utf-8"></head><body>' + tableHtml + '</body></html>';
|
|
1210
|
-
}
|
|
1211
|
-
function tableToTsv(table){
|
|
1212
|
-
var rows = Array.prototype.filter.call(table.querySelectorAll('tr'), function(r){ return !r.classList.contains('detail-row'); });
|
|
1213
|
-
return rows.map(function(r){
|
|
1214
|
-
return Array.prototype.map.call(r.querySelectorAll('th, td'), function(c){
|
|
1215
|
-
return (c.innerText || c.textContent || '').replace(/[\t\r\n]+/g, ' ').trim();
|
|
1216
|
-
}).join('\t');
|
|
1217
|
-
}).join('\n');
|
|
1218
|
-
}
|
|
1219
|
-
function flash(btn, cls, msg){
|
|
1220
|
-
var old = btn.textContent;
|
|
1221
|
-
btn.textContent = msg;
|
|
1222
|
-
btn.classList.add(cls);
|
|
1223
|
-
setTimeout(function(){
|
|
1224
|
-
btn.textContent = old;
|
|
1225
|
-
btn.classList.remove(cls);
|
|
1226
|
-
}, 1500);
|
|
1227
|
-
}
|
|
1228
|
-
// Write rich HTML (+ plain-text fallback) to the clipboard. Shared by the
|
|
1229
|
-
// table buttons and the executive-summary button. richInner is the HTML
|
|
1230
|
-
// fragment; we wrap it with the Office namespaces so Word keeps formatting.
|
|
1231
|
-
async function writeClipboard(richInner, plain, btn){
|
|
1232
|
-
var html = wordWrapper(richInner);
|
|
1233
|
-
// Modern path: ClipboardItem with text/html + text/plain
|
|
1234
|
-
try {
|
|
1235
|
-
if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
|
|
1236
|
-
await navigator.clipboard.write([
|
|
1237
|
-
new ClipboardItem({
|
|
1238
|
-
'text/html': new Blob([html], { type: 'text/html' }),
|
|
1239
|
-
'text/plain': new Blob([plain], { type: 'text/plain' })
|
|
1240
|
-
})
|
|
1241
|
-
]);
|
|
1242
|
-
flash(btn, 'flashing-ok', '✓ Copied!');
|
|
1243
|
-
return;
|
|
1244
|
-
}
|
|
1245
|
-
} catch(e) { /* fall through to legacy path */ }
|
|
1246
|
-
// Legacy path: select a contenteditable clone, execCommand('copy')
|
|
1247
|
-
try {
|
|
1248
|
-
var temp = document.createElement('div');
|
|
1249
|
-
temp.setAttribute('contenteditable', 'true');
|
|
1250
|
-
temp.style.position = 'fixed';
|
|
1251
|
-
temp.style.left = '-9999px';
|
|
1252
|
-
temp.style.top = '0';
|
|
1253
|
-
temp.innerHTML = richInner;
|
|
1254
|
-
document.body.appendChild(temp);
|
|
1255
|
-
var range = document.createRange();
|
|
1256
|
-
range.selectNodeContents(temp);
|
|
1257
|
-
var sel = window.getSelection();
|
|
1258
|
-
sel.removeAllRanges();
|
|
1259
|
-
sel.addRange(range);
|
|
1260
|
-
var ok = document.execCommand('copy');
|
|
1261
|
-
sel.removeAllRanges();
|
|
1262
|
-
document.body.removeChild(temp);
|
|
1263
|
-
flash(btn, ok ? 'flashing-ok' : 'flashing-err', ok ? '✓ Copied!' : '✗ Copy failed');
|
|
1264
|
-
} catch(e) {
|
|
1265
|
-
flash(btn, 'flashing-err', '✗ Copy failed');
|
|
1266
|
-
}
|
|
1267
|
-
}
|
|
1268
|
-
function copyTable(table, btn){
|
|
1269
|
-
var clone = inlineStylesForWord(table);
|
|
1270
|
-
return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
|
|
1271
|
-
}
|
|
1272
|
-
document.querySelectorAll('.btn-copy').forEach(function(btn){
|
|
1273
|
-
// The executive-summary button is wired separately (it copies a prose
|
|
1274
|
-
// summary, not a table).
|
|
1275
|
-
if (btn.classList.contains('exec-copy-btn')) return;
|
|
1276
|
-
btn.addEventListener('click', function(e){
|
|
1277
|
-
e.stopPropagation();
|
|
1278
|
-
var wrap = btn.closest('.table-wrap');
|
|
1279
|
-
var table = wrap && wrap.querySelector('table');
|
|
1280
|
-
if (table) copyTable(table, btn);
|
|
1281
|
-
});
|
|
1282
|
-
});
|
|
1283
|
-
var execBtn = document.querySelector('.exec-copy-btn');
|
|
1284
|
-
if (execBtn) execBtn.addEventListener('click', function(e){
|
|
1285
|
-
e.stopPropagation();
|
|
1286
|
-
var tpl = document.querySelector('.exec-copy-rich');
|
|
1287
|
-
var ta = document.querySelector('.exec-copy-plain');
|
|
1288
|
-
var rich = tpl ? (tpl.innerHTML || '') : '';
|
|
1289
|
-
var plain = ta ? (ta.value || '') : '';
|
|
1290
|
-
writeClipboard(rich, plain, execBtn);
|
|
1291
|
-
});
|
|
1292
|
-
})();
|
|
1293
|
-
</script></body></html>
|