mirror of
https://github.com/linuxserver/cstate.git
synced 2026-02-20 07:55:25 +08:00
deploy: 56ae9b4efd07c42e54427e958a790ee4c948bb5f
This commit is contained in:
Roxedus
parent
9358168fe1
commit
fa17ea8942
@ -1 +1 @@
|
||||
{"is":"system","title":"airsonic","permalink":"https://info.linuxserver.io/affected/airsonic/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Airsonic Deprecation","createdAt":"2021-09-07 00:00:00 +0000 UTC","lastMod":"2021-10-15 09:27:28 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-09-07-airsonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["Deprecations","airsonic"],"filename":"2021-09-07-airsonic.md"},{"is":"issue","title":"New Container: Airsonic","createdAt":"2017-12-29 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2017-12-29-airsonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","airsonic"],"filename":"2017-12-29-airsonic.md"}]}
|
||||
{"is":"system","title":"airsonic","permalink":"https://info.linuxserver.io/affected/airsonic/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Airsonic Deprecation","createdAt":"2021-09-07 00:00:00 +0000 UTC","lastMod":"2021-10-15 09:27:28 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-09-07-airsonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["Deprecations","airsonic"],"filename":"2021-09-07-airsonic.md"},{"is":"issue","title":"New Container: Airsonic","createdAt":"2017-12-29 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2017-12-29-airsonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","airsonic"],"filename":"2017-12-29-airsonic.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"booksonic-air","permalink":"https://info.linuxserver.io/affected/booksonic-air/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Booksonic-Air","createdAt":"2020-09-15 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2020-09-15-booksonic-air/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","booksonic-air"],"filename":"2020-09-15-booksonic-air.md"}]}
|
||||
{"is":"system","title":"booksonic-air","permalink":"https://info.linuxserver.io/affected/booksonic-air/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Booksonic-Air","createdAt":"2020-09-15 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2020-09-15-booksonic-air/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","booksonic-air"],"filename":"2020-09-15-booksonic-air.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"booksonic","permalink":"https://info.linuxserver.io/affected/booksonic/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Booksonic","createdAt":"2016-12-13 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-12-13-booksonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","booksonic"],"filename":"2016-12-13-booksonic.md"}]}
|
||||
{"is":"system","title":"booksonic","permalink":"https://info.linuxserver.io/affected/booksonic/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Booksonic","createdAt":"2016-12-13 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-12-13-booksonic/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","booksonic"],"filename":"2016-12-13-booksonic.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"davos","permalink":"https://info.linuxserver.io/affected/davos/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Davos","createdAt":"2016-11-18 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-11-18-davos/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","davos"],"filename":"2016-11-18-davos.md"}]}
|
||||
{"is":"system","title":"davos","permalink":"https://info.linuxserver.io/affected/davos/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Davos","createdAt":"2016-11-18 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-11-18-davos/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","davos"],"filename":"2016-11-18-davos.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"fleet","permalink":"https://info.linuxserver.io/affected/fleet/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Fleet","createdAt":"2019-04-01 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2019-04-01-fleet/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","fleet"],"filename":"2019-04-01-fleet.md"}]}
|
||||
{"is":"system","title":"fleet","permalink":"https://info.linuxserver.io/affected/fleet/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Fleet","createdAt":"2019-04-01 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2019-04-01-fleet/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","fleet"],"filename":"2019-04-01-fleet.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"habridge","permalink":"https://info.linuxserver.io/affected/habridge/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Habridge","createdAt":"2018-04-08 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2018-04-08-habridge/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","habridge"],"filename":"2018-04-08-habridge.md"}]}
|
||||
{"is":"system","title":"habridge","permalink":"https://info.linuxserver.io/affected/habridge/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Habridge","createdAt":"2018-04-08 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2018-04-08-habridge/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","habridge"],"filename":"2018-04-08-habridge.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"nzbhydra2","permalink":"https://info.linuxserver.io/affected/nzbhydra2/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Nzbhydra2","createdAt":"2018-01-11 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2018-01-11-nzbhydra2/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","nzbhydra2"],"filename":"2018-01-11-nzbhydra2.md"}]}
|
||||
{"is":"system","title":"nzbhydra2","permalink":"https://info.linuxserver.io/affected/nzbhydra2/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Nzbhydra2","createdAt":"2018-01-11 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2018-01-11-nzbhydra2/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","nzbhydra2"],"filename":"2018-01-11-nzbhydra2.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"ubooquity","permalink":"https://info.linuxserver.io/affected/ubooquity/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Ubooquity","createdAt":"2016-12-06 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-12-06-ubooquity/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","ubooquity"],"filename":"2016-12-06-ubooquity.md"}]}
|
||||
{"is":"system","title":"ubooquity","permalink":"https://info.linuxserver.io/affected/ubooquity/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"New Container: Ubooquity","createdAt":"2016-12-06 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2016-12-06-ubooquity/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","ubooquity"],"filename":"2016-12-06-ubooquity.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"unifi-controller","permalink":"https://info.linuxserver.io/affected/unifi-controller/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Unifi Controller 32-bit ARM Deprecation Notice","createdAt":"2021-11-25 00:00:00 +0000 UTC","lastMod":"2021-11-25 09:59:07 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-11-25-unifi/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["Deprecations","unifi-controller"],"filename":"2021-11-25-unifi.md"},{"is":"issue","title":"Known Issue: Unifi Controller v6.2.23","createdAt":"2021-05-08 00:00:00 +0000 UTC","lastMod":"2021-05-26 18:55:34 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-13-unifi-controller/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-14","affected":["Known Issues","unifi-controller"],"filename":"2021-05-13-unifi-controller.md"},{"is":"issue","title":"New Container: Unifi-Controller","createdAt":"2019-02-10 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2019-02-10-unifi-controller/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","unifi-controller"],"filename":"2019-02-10-unifi-controller.md"}]}
|
||||
{"is":"system","title":"unifi-controller","permalink":"https://info.linuxserver.io/affected/unifi-controller/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Unifi Controller 32-bit ARM Deprecation Notice","createdAt":"2021-11-25 00:00:00 +0000 UTC","lastMod":"2021-11-25 09:59:07 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-11-25-unifi/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["Deprecations","unifi-controller"],"filename":"2021-11-25-unifi.md"},{"is":"issue","title":"Known Issue: Unifi Controller v6.2.23","createdAt":"2021-05-08 00:00:00 +0000 UTC","lastMod":"2021-05-26 18:55:34 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-13-unifi-controller/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-14","affected":["Known Issues","unifi-controller"],"filename":"2021-05-13-unifi-controller.md"},{"is":"issue","title":"New Container: Unifi-Controller","createdAt":"2019-02-10 00:00:00 +0000 UTC","lastMod":"2021-07-03 00:52:41 +0200 +0200","permalink":"https://info.linuxserver.io/issues/2019-02-10-unifi-controller/","severity":"<no value>","resolved":false,"informational":true,"resolvedAt":"<no value>","affected":["New Containers","unifi-controller"],"filename":"2019-02-10-unifi-controller.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"system","title":"Vulnerabilities","permalink":"https://info.linuxserver.io/affected/vulnerabilities/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Authelia Vulnerability","createdAt":"2021-05-30 00:00:00 +0000 UTC","lastMod":"2021-05-30 16:53:02 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-30-authelia/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-30","affected":["Vulnerabilities","authelia","swag"],"filename":"2021-05-30-authelia.md"}]}
|
||||
{"is":"system","title":"Vulnerabilities","permalink":"https://info.linuxserver.io/affected/vulnerabilities/","status":"notice","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Authelia Vulnerability","createdAt":"2021-05-30 00:00:00 +0000 UTC","lastMod":"2021-05-30 16:53:02 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-30-authelia/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-30","affected":["Vulnerabilities","authelia","swag"],"filename":"2021-05-30-authelia.md"}]}
|
||||
@ -6,6 +6,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -15,7 +16,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -1 +1 @@
|
||||
{"is":"index","cStateVersion":"5.2","apiVersion":"2.0","title":"Info :: LinuxServer.io","languageCodeHTML":"en","languageCode":"en","baseURL":"https://info.linuxserver.io","description":"<no value>","summaryStatus":"notice","categories":[{"name":"Images","description":"Information regarding our images","hideTitle":false,"closedByDefault":false},{"name":"Security","hideTitle":false,"closedByDefault":false}],"systems":[{"name":"Deprecations","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"New Containers","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Vulnerabilities","category":"Security","status":"notice","unresolvedIssues":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"}]},{"name":"Known Issues","category":"Images","status":"ok","unresolvedIssues":[]}],"buildDate":"2021-12-15","buildTime":"23:12","buildTimezone":"UTC","colorBrand":"#0a0c0f","colorOk":"#008000","colorDisrupted":"#cc4400","colorDown":"#e60000","colorNotice":"#24478f","alwaysKeepBrandColor":"true","logo":"https://info.linuxserver.io/logo.png","googleAnalytics":"UA-00000000-1"}
|
||||
{"is":"index","cStateVersion":"5.2","apiVersion":"2.0","title":"Info :: LinuxServer.io","languageCodeHTML":"en","languageCode":"en","baseURL":"https://info.linuxserver.io","description":"<no value>","summaryStatus":"notice","categories":[{"name":"Images","description":"Information regarding our images","hideTitle":false,"closedByDefault":false},{"name":"Security","hideTitle":false,"closedByDefault":false}],"systems":[{"name":"Deprecations","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"New Containers","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Vulnerabilities","category":"Security","status":"notice","unresolvedIssues":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"}]},{"name":"Known Issues","category":"Images","status":"ok","unresolvedIssues":[]}],"buildDate":"2021-12-17","buildTime":"10:47","buildTimezone":"UTC","colorBrand":"#0a0c0f","colorOk":"#008000","colorDisrupted":"#cc4400","colorDown":"#e60000","colorNotice":"#24478f","alwaysKeepBrandColor":"true","logo":"https://info.linuxserver.io/logo.png","googleAnalytics":"UA-00000000-1"}
|
||||
@ -8,6 +8,7 @@
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -17,7 +18,6 @@
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
@ -9,8 +9,8 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<a href=/affected/davos/ class="tag no-underline">davos</a>
|
||||
<a href=/affected/booksonic/ class="tag no-underline">booksonic</a>
|
||||
<a href=/affected/ubooquity/ class="tag no-underline">ubooquity</a></small></p><strong class=error>◆
|
||||
This issue is not resolved yet</strong><hr><p>Multiple vulnerabilities (<a href=https://nvd.nist.gov/vuln/detail/CVE-2021-44228>CVE-2021-44228</a> and <a href=https://nvd.nist.gov/vuln/detail/CVE-2021-45046>CVE-2021-45046</a>) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 <em>or</em> CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.</p><p><strong>Please note these lists apply to the stated version tags and later <em>only</em>. If you are running older versions of the images they may still be vulnerable.</strong></p><ul><li><a href=https://github.com/linuxserver/docker-fleet>Fleet</a> - <code>version-2.3.2</code> and later (Workaround applied + upstream fix)</li><li><a href=https://github.com/linuxserver/docker-airsonic>Airsonic</a> (No log4j-core in use)</li><li><a href=https://github.com/linuxserver/docker-habridge>HABridge</a> (No log4j-core in use)</li><li><a href=https://github.com/linuxserver/docker-unifi-controller>Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li></ul><p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p><ul><li><a href=https://github.com/linuxserver/docker-unifi-controller>Unifi Controller</a> - <code>version-6.5.54</code> and later (Workaround applied + upstream fix)</li><li><a href=https://github.com/linuxserver/docker-booksonic-air/>Booksonic Air</a> - <code>version-v2112.1.0</code> and later (Upstream fix)</li><li><a href=https://github.com/linuxserver/docker-nzbhydra2>nzbhydra2</a> - <code>version-v3.18.4</code> and later (Upstream fix)</li></ul><p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p><ul><li><a href=https://github.com/linuxserver/docker-davos>Davos</a></li><li><a href=https://github.com/linuxserver/docker-booksonic>Booksonic</a> (Deprecated)</li></ul><p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p><ul><li><a href=https://github.com/linuxserver/docker-ubooquity>Ubooquity</a></li></ul><p>We will update this post as more information becomes available.</p></div><div class=padding></div></div><div class="contain center"><p>Last updated:
|
||||
December 15, 2021 at 11:08 PM</p></div><script type=text/javascript>console.log('cState v5.2 - https://github.com/cstate/cstate'),document.getElementsByTagName('html')[0].className='js',document.body.className==='change-header-color'&&(document.body.className==='status-down'?document.querySelector('meta[name=theme-color]').setAttribute('content',themeDownColor):document.body.className==='status-disrupted'?document.querySelector('meta[name=theme-color]').setAttribute('content',themeDisruptedColor):document.querySelector('meta[name=theme-color]').setAttribute('content',themeNoticeColor)),window.location.hash.match('access_token')&&(document.location.pathname='/admin'),window.location.hash.match('invite_token')&&(document.location.pathname='/admin'),window.location.hash.match('confirmation_token')&&(document.location.pathname='/admin'),window.location.hash.match('email_change_token')&&(document.location.pathname='/admin'),window.location.hash.match('recovery_token')&&(document.location.pathname='/admin');function toggleCategoryHead(a){a.parentNode.className=='category category--open category--titled'?a.parentNode.className='category category--closed category--titled':a.parentNode.className='category category--open category--titled'}function timeSince(c){var b=Math.floor((new Date-c)/1e3),a=Math.floor(b/31536e3);return a>1?a+' years':(a=Math.floor(b/2592e3),a>1)?a+' months':(a=Math.floor(b/86400),a>1)?a+'d':(a=Math.floor(b/3600),a>1)?a+'h':(a=Math.floor(b/60),a>1)?a+' min':Math.floor(b)<0?Math.floor(b):Math.floor(b)+'s'}function updateRelativeTimes(){for(var e=document.querySelectorAll('.relative-time'),d=0,a,b,c;d<e.length;d++)a=e[d],b=Date.parse(a.getAttribute('title')),c=a.getAttribute('data-time-prefix')||'',b?timeSince(b)<0?c=a.innerText:c+=timeSince(b)+' ago':(b=a.innerText,a.setAttribute('title',b||new Date),c+='just now'),c+=a.getAttribute('data-time-suffix')||'',a.innerHTML=c.trim()}updateRelativeTimes(),setInterval(updateRelativeTimes,5e3)</script><div class=footer><div class=contain><p><strong class=bold>© Info :: LinuxServer.io, 2021</strong>
|
||||
This issue is not resolved yet</strong><hr><p>Multiple vulnerabilities (<a href=https://nvd.nist.gov/vuln/detail/CVE-2021-44228>CVE-2021-44228</a> and <a href=https://nvd.nist.gov/vuln/detail/CVE-2021-45046>CVE-2021-45046</a>) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 <em>or</em> CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.</p><p><strong>Please note these lists apply to the stated version tags and later <em>only</em>. If you are running older versions of the images they may still be vulnerable.</strong></p><ul><li><a href=https://github.com/linuxserver/docker-fleet>Fleet</a> - <code>version-2.3.2</code> and later (Workaround applied + upstream fix)</li><li><a href=https://github.com/linuxserver/docker-airsonic>Airsonic</a> (No log4j-core in use)</li><li><a href=https://github.com/linuxserver/docker-habridge>HABridge</a> (No log4j-core in use)</li><li><a href=https://github.com/linuxserver/docker-unifi-controller>Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li><li><a href=https://github.com/linuxserver/docker-davos>Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li></ul><p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p><ul><li><a href=https://github.com/linuxserver/docker-unifi-controller>Unifi Controller</a> - <code>version-6.5.54</code> and later (Workaround applied + upstream fix)</li><li><a href=https://github.com/linuxserver/docker-booksonic-air/>Booksonic Air</a> - <code>version-v2112.1.0</code> and later (Upstream fix)</li><li><a href=https://github.com/linuxserver/docker-nzbhydra2>nzbhydra2</a> - <code>version-v3.18.4</code> and later (Upstream fix)</li></ul><p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p><ul><li><a href=https://github.com/linuxserver/docker-booksonic>Booksonic</a> (Deprecated)</li></ul><p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p><ul><li><a href=https://github.com/linuxserver/docker-ubooquity>Ubooquity</a></li></ul><p>We will update this post as more information becomes available.</p></div><div class=padding></div></div><div class="contain center"><p>Last updated:
|
||||
December 17, 2021 at 10:32 AM</p></div><script type=text/javascript>console.log('cState v5.2 - https://github.com/cstate/cstate'),document.getElementsByTagName('html')[0].className='js',document.body.className==='change-header-color'&&(document.body.className==='status-down'?document.querySelector('meta[name=theme-color]').setAttribute('content',themeDownColor):document.body.className==='status-disrupted'?document.querySelector('meta[name=theme-color]').setAttribute('content',themeDisruptedColor):document.querySelector('meta[name=theme-color]').setAttribute('content',themeNoticeColor)),window.location.hash.match('access_token')&&(document.location.pathname='/admin'),window.location.hash.match('invite_token')&&(document.location.pathname='/admin'),window.location.hash.match('confirmation_token')&&(document.location.pathname='/admin'),window.location.hash.match('email_change_token')&&(document.location.pathname='/admin'),window.location.hash.match('recovery_token')&&(document.location.pathname='/admin');function toggleCategoryHead(a){a.parentNode.className=='category category--open category--titled'?a.parentNode.className='category category--closed category--titled':a.parentNode.className='category category--open category--titled'}function timeSince(c){var b=Math.floor((new Date-c)/1e3),a=Math.floor(b/31536e3);return a>1?a+' years':(a=Math.floor(b/2592e3),a>1)?a+' months':(a=Math.floor(b/86400),a>1)?a+'d':(a=Math.floor(b/3600),a>1)?a+'h':(a=Math.floor(b/60),a>1)?a+' min':Math.floor(b)<0?Math.floor(b):Math.floor(b)+'s'}function updateRelativeTimes(){for(var e=document.querySelectorAll('.relative-time'),d=0,a,b,c;d<e.length;d++)a=e[d],b=Date.parse(a.getAttribute('title')),c=a.getAttribute('data-time-prefix')||'',b?timeSince(b)<0?c=a.innerText:c+=timeSince(b)+' ago':(b=a.innerText,a.setAttribute('title',b||new Date),c+='just now'),c+=a.getAttribute('data-time-suffix')||'',a.innerHTML=c.trim()}updateRelativeTimes(),setInterval(updateRelativeTimes,5e3)</script><div class=footer><div class=contain><p><strong class=bold>© Info :: LinuxServer.io, 2021</strong>
|
||||
• <a href=#>Back to top</a></p><p></p><small class="footer__copyright faded">Powered by <a href=https://github.com/cstate/cstate><b>cState</b></a></small><hr><p class=hinted><small>⚡
|
||||
Subscribe via RSS —
|
||||
<a href=https://info.linuxserver.io/index.xml class=no-underline>to all updates</a></small></p></div></div></body></html>
|
||||
@ -1 +1 @@
|
||||
{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-15 23:08:24 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"}
|
||||
{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2021-12-17 10:32:08 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"}
|
||||
File diff suppressed because one or more lines are too long
@ -10,6 +10,7 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
||||
<ul>
|
||||
@ -19,7 +20,6 @@ Please note these lists apply to the stated version tags and later only. If you
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
||||
<ul>
|
||||
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a></li>
|
||||
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
||||
</ul>
|
||||
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java based and so may be using log4j in some capacity.</p>
|
||||
|
||||
File diff suppressed because one or more lines are too long
Loading…
x
Reference in New Issue
Block a user