CVE-2022-23305
published 2022-01-18CVE-2022-23305: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
66.54%
99.2th percentile
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | log4j | 1.2 – 1.2.17 | — |
| apache_software_foundation | apache_log4j_1.x | >= 1.2.1 < unspecified | unspecified |
| apache_software_foundation | apache_log4j_1.x | >= unspecified < 2.0-alpha1 | 2.0-alpha1 |
| debian | apache-log4j1.2 | < apache-log4j1.2 1.2.17-11 (bookworm) | apache-log4j1.2 1.2.17-11 (bookworm) |
| oracle | advanced_supply_chain_planning | — | — |
| oracle | advanced_supply_chain_planning | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | communications_eagle_ftp_table_base_retrieval | — | — |
| oracle | communications_instant_messaging_server | — | — |
| oracle | communications_messaging_server | — | — |
| oracle | communications_network_integrity | — | — |
| oracle | communications_offline_mediation_controller | < 12.0.0.4.4 | 12.0.0.4.4 |
| oracle | communications_offline_mediation_controller | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | < 2.2.1.1.1 | 2.2.1.1.1 |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | — | — |
| oracle | e-business_suite_information_discovery | 12.2.3 – 12.2.11 | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | financial_services_revenue_management_and_billing_analytics | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →SQL injection vector is the %m (message converter) in JDBCAppender's PatternLayout SQL configuration — monitor for SQL metacharacters in logged input fields or HTTP headers when JDBCAppender is in use ↗
- →Vulnerability is only exploitable when Log4j 1.x is explicitly configured to use JDBCAppender — audit log4j configuration files for presence of JDBCAppender to determine exposure ↗
- →Affected component path to monitor/block in deployed JARs: org/apache/log4j/jdbc/JDBCAppender.class ↗
- ·Vulnerability only affects Log4j 1.x (specifically 1.2.x) — Log4j 2.x re-introduced JDBCAppender with parameterized SQL queries and is not affected by this SQLi issue ↗
- ·Red Hat products using log4j-over-slf4j (e.g., Red Hat Satellite with Candlepin using logback) are not affected; JDBCAppender must actually be in use for exploitation ↗
- ·Red Hat Virtualization and OpenShift Container Platform (Hive/Presto/Hadoop) ship vulnerable log4j 1.x but JDBCAppender is not used, so impact is rated Low for those products ↗
- ·Apache Log4j 1.2 is end-of-life since August 2015; 32% of surveyed apps still use 1.2.x, making this a widespread latent risk ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apache-log4j1.2 vulnerabilities
osv·2025-06-23·CVSS 8.8
CVE-2022-23302 [HIGH] apache-log4j1.2 vulnerabilities
apache-log4j1.2 vulnerabilities
It was discovered that several deserialization issues existed within Apache
Log4j. An attacker could possibly use these issues to enable the execution
of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)
OSV
apache-log4j1.2 vulnerabilities
osv·2023-04-05·CVSS 9.8
CVE-2019-17571 [CRITICAL] apache-log4j1.2 vulnerabilities
apache-log4j1.2 vulnerabilities
It was discovered that the SocketServer component of Apache Log4j 1.2
incorrectly handled deserialization. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2019-17571)
It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-23302)
It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL
statements. A remote attacker could possibly use this issue to perform an SQL
injection attack and alter the database. This issue was only fixed in Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)
It was discovered that the Chainsaw component of Apache Log4j 1.
GHSA
SQL Injection in Log4j 1.2.x
ghsa·2022-01-21
CVE-2022-23305 [CRITICAL] CWE-89 SQL Injection in Log4j 1.2.x
SQL Injection in Log4j 1.2.x
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users shoul
OSV
SQL Injection in Log4j 1.2.x
osv·2022-01-21
CVE-2022-23305 [CRITICAL] SQL Injection in Log4j 1.2.x
SQL Injection in Log4j 1.2.x
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users shoul
OSV
CVE-2022-23305: By design, the JDBCAppender in Log4j 1
osv·2022-01-18·CVSS 9.8
CVE-2022-23305 [CRITICAL] CVE-2022-23305: By design, the JDBCAppender in Log4j 1
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it add
Ubuntu
Apache Log4j vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 8.8
CVE-2022-23302 [HIGH] Apache Log4j vulnerabilities
Title: Apache Log4j vulnerabilities
Summary: Apache Log4j could be made to run programs as your login if it opened a
specially crafted file.
It was discovered that several deserialization issues existed within Apache
Log4j. An attacker could possibly use these issues to enable the execution
of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Analytics Risk Matrix: BI Application Archive (Apache Log4j) — CVE-2022-23305
vendor_oracle·2024-10-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Analytics Risk Matrix: BI Application Archive (Apache Log4j) — CVE-2022-23305
Oracle Oracle Analytics Risk Matrix: BI Application Archive (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (Apache Log4j) — CVE-2022-23305
vendor_oracle·2023-07-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (Apache Log4j) — CVE-2022-23305
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Utilities Applications Risk Matrix: General (Apache Log4j) — CVE-2022-23305
vendor_oracle·2023-04-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Utilities Applications Risk Matrix: General (Apache Log4j) — CVE-2022-23305
Oracle Oracle Utilities Applications Risk Matrix: General (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Ubuntu
Apache Log4j vulnerabilities
vendor_ubuntu·2023-04-05·CVSS 9.8
CVE-2019-17571 [CRITICAL] Apache Log4j vulnerabilities
Title: Apache Log4j vulnerabilities
Summary: Several security issues were fixed in Apache Log4j.
It was discovered that the SocketServer component of Apache Log4j 1.2
incorrectly handled deserialization. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2019-17571)
It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-23302)
It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL
statements. A remote attacker could possibly use this issue to perform an SQL
injection attack and alter the database. This issue was only fixed in Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache Log4j) — CVE-2022-23305
vendor_oracle·2023-01-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache Log4j) — CVE-2022-23305
Oracle Oracle Fusion Middleware Risk Matrix: Core (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Oracle
Oracle Oracle E-Business Suite Risk Matrix: EBS EM Plugin (Apache Log4j) — CVE-2022-23305
vendor_oracle·2022-10-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle E-Business Suite Risk Matrix: EBS EM Plugin (Apache Log4j) — CVE-2022-23305
Oracle Oracle E-Business Suite Risk Matrix: EBS EM Plugin (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: XMPP Server (Apache Log4j) — CVE-2022-23305
vendor_oracle·2022-07-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: XMPP Server (Apache Log4j) — CVE-2022-23305
Oracle Oracle Communications Applications Risk Matrix: XMPP Server (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: XMPP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Log4j) — CVE-2022-23305
vendor_oracle·2022-04-15·CVSS 9.8
CVE-2022-23305 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Log4j) — CVE-2022-23305
Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Log4j) vulnerability
CVE: CVE-2022-23305
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
vendor_redhat·2022-01-18·CVSS 9.8
CVE-2022-23305 [CRITICAL] CWE-89 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache L
Debian
CVE-2022-23305: apache-log4j1.2 - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configu...
vendor_debian·2022·CVSS 9.8
CVE-2022-23305 [CRITICAL] CVE-2022-23305: apache-log4j1.2 - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configu...
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it add
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, October 2024 Security Update Review
blogs_qualys·2024-10-16
Oracle Critical Patch Update, October 2024 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle released the last quarterly edition of this year’s Critical Patch Update. The update contains patches for 334 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 100 constituting about 30% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 45 and 32 security patches, respectively.
244
Qualys
Oracle Critical Patch Security Update: October 2024 | Qualys
blogs_qualys·2024-10-16
Oracle Critical Patch Security Update: October 2024 | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle released the last quarterly edition of this year’s Critical Patch Update. The update contains patches for 334 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 100 constituting about 30% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 45 and 32 security patches, respectively.
Bleepingcomputer
Over 30% of Log4J apps use a vulnerable version of the library
blogs_bleepingcomputer·2023-12-10·CVSS 10.0
CVE-2021-44228 [CRITICAL] Over 30% of Log4J apps use a vulnerable version of the library
## Over 30% of Log4J apps use a vulnerable version of the library
## Bill Toulas
Roughly 38% of applications using the Apache Log4j library are using a version vulnerable to security issues, including Log4Shell, a critical vulnerability identified as CVE-2021-44228 that carries the maximum severity rating, despite patches being available for more than two years.
Log4Shell is an unauthenticated remote code execution (RCE) flaw that allows taking complete control over systems with Log4j 2.0-beta9 and up to 2.15.0.
The flaw was discovered as an actively exploited zero-day on December 10, 2021, and its widespread impact, ease of exploitation, and massive security implications acted as an open invitation to threat actors.
The circumstance prompted an extensive campaign to notify affected p
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followed, with
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followe
Tenable
Oracle July 2022 Critical Patch Update Addresses 188 CVEs
blogs_tenable·2022-07-20
Oracle July 2022 Critical Patch Update Addresses 188 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
arXiv
Attack Techniques and Threat Identification for Vulnerabilities
arxiv_fulltext·2022-06-22
Attack Techniques and Threat Identification for Vulnerabilities
Attack Techniques and Threat Identification for Vulnerabilities
Constantin Adam
Muhammed Fatih Bulut
Daby Sow
cmadam, mfbulut, [email protected]
IBM T.J. Watson Research Center
Yorktown Heights
NY
USA
Steven Ocepek
Chris Bedell
steve.ocepek, [email protected]
IBM Security X-Force Red
USA
Lilian Ngweta
[email protected]
Rensselaer Polytechnic Institute
Troy
NY
USA
Adam and Bulut, et al.
## Abstract
Modern organizations struggle with what is often considered an insurmountable number of vulnerabilities that are discovered and reported by their network and application vulnerability scanners. Therefore, prioritization and focus become critical, to spend their limited time on the highest risk vulnerabilities. In doing this, it is important for these organizations not only to
Bugzilla
CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
bugzilla·2022-01-18·CVSS 9.8
CVE-2022-23305 [CRITICAL] CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converted from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed.
Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in
http://www.openwall.com/lists/oss-security/2022/01/18/4https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85yhttps://logging.apache.org/log4j/1.2/index.htmlhttps://security.netapp.com/advisory/ntap-20220217-0007/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttp://www.openwall.com/lists/oss-security/2022/01/18/4https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85yhttps://logging.apache.org/log4j/1.2/index.htmlhttps://security.netapp.com/advisory/ntap-20220217-0007/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2022-01-18
Published