[Git][security-tracker-team/security-tracker][master] apache-log4j2 fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4dbc7007 by Moritz Muehlenhoff at 2026-10-16T17:29:16+02:00
apache-log4j2 fixed in sid

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -122066,7 +122066,7 @@ CVE-2026-52747 (ModSecurity is an open source, cross platform web application fi
 CVE-2026-4661 (The WP CTA \u2013 Sticky CTA Builder, Generate Leads, Promote Sales pl ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-49844 (Improper encoding of non-finite floating-point values during MapMessag ...)
-	- apache-log4j2 <unfixed> (bug #1141960)
+	- apache-log4j2 2.26.1-1 (bug #1141960)
 	[trixie] - apache-log4j2 <no-dsa> (Minor issue)
 	[bookworm] - apache-log4j2 <postponed> (Minor issue; same as CVE-2026-34481)
 	NOTE: https://logging.apache.org/security.html#CVE-2026-49844
@@ -185602,7 +185602,7 @@ CVE-2026-35594 (Vikunja is an open-source self-hosted task management platform.
 CVE-2026-34727 (Vikunja is an open-source self-hosted task management platform. Prior  ...)
 	NOT-FOR-US: Vikunja
 CVE-2026-34481 (Apache Log4j's  JsonTemplateLayout https://logging.apache.org/log4j/2. ...)
-	- apache-log4j2 <unfixed> (bug #1133846)
+	- apache-log4j2 2.26.1-1 (bug #1133846)
 	[trixie] - apache-log4j2 <no-dsa> (Minor issue)
 	[bookworm] - apache-log4j2 <no-dsa> (Minor issue)
 	- apache-log4j1.2 <not-affected> (Vulnerable code not present)
@@ -185611,7 +185611,7 @@ CVE-2026-34481 (Apache Log4j's  JsonTemplateLayout https://logging.apache.org/lo
 	NOTE: https://github.com/apache/logging-log4j2/pull/4080
 	NOTE: Fixed by: https://github.com/apache/logging-log4j2/commit/2c4dd1db372c59ad73aca88e281635fe30072268 (rel/2.25.4)
 CVE-2026-34480 (Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/ma ...)
-	- apache-log4j2 <unfixed> (bug #1133847)
+	- apache-log4j2 2.26.1-1 (bug #1133847)
 	[trixie] - apache-log4j2 <no-dsa> (Minor issue)
 	[bookworm] - apache-log4j2 <no-dsa> (Minor issue)
 	[bullseye] - apache-log4j2 <postponed> (Minor issue, can be fixed with next upload)
@@ -185624,7 +185624,7 @@ CVE-2026-34480 (Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/
 	NOTE: https://github.com/apache/logging-log4j2/pull/4077
 	NOTE: Fixed by: https://github.com/apache/logging-log4j2/commit/4f5014229825d8be977662e0743205bb8a67f989 (rel/2.25.4)
 CVE-2026-34479 (The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to ...)
-	- apache-log4j2 <unfixed> (bug #1133848)
+	- apache-log4j2 2.26.1-1 (bug #1133848)
 	[trixie] - apache-log4j2 <no-dsa> (Minor issue)
 	[bookworm] - apache-log4j2 <no-dsa> (Minor issue)
 	- apache-log4j1.2 <not-affected> (Vulnerable code not present)
@@ -238162,7 +238162,7 @@ CVE-2025-68279 (Weblate is a web based localization tool. In versions prior to 5
 	- weblate <itp> (bug #745661)
 CVE-2025-68161 (The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...)
 	{DLA-4444-1}
-	- apache-log4j2 <unfixed> (bug #1123744)
+	- apache-log4j2 2.26.1-1 (bug #1123744)
 	[trixie] - apache-log4j2 <no-dsa> (Minor issue)
 	[bookworm] - apache-log4j2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/apache/logging-log4j2/pull/4002



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4dbc70071a8461a41512de341ac28f2083c6972f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4dbc70071a8461a41512de341ac28f2083c6972f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/e080684e/attachment.htm>