Date: Wed, 22 Jun 2022 07:15:42 +0000 From: Robert Munteanu <rombert@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2022-32549: Apache Sling: log injection in Sling logging Severity: important Description: Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files. Credit: Apache Sling would like to thank Alex Collignon for reporting this issue.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.