CVE-2022-23307

Name of the Vulnerable Software and Affected Versions Apache Log4j versions 1.2.x Apache Log4j (affected versions not specified)

Description The issue is related to the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code. It is also identified as a deserialization issue that was present in Apache Chainsaw, a component of Apache Log4j 1.2.x.

Recommendations For Apache Log4j versions 1.2.x, migrate from log4j:log4j to org.apache.logging.log4j:log4j for an updated version of the library. At the moment, there is no information about a newer version that contains a fix for this vulnerability in other affected versions.