Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ops4j/org.ops4j.pax.logging

              main @ 476c826
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Remote Code Execution: 5 prior fixes. Scrutinize any change in this area.

pax-logging-log4j2: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: JNDI lookup in log messages via MessagePatternConverter allows remote attackers to execute arbitrary code by injecting malicious JNDI URIs into log content. Multiple upgrades were needed to close the same sink, indicating the risk recurs with each new log4j2 vulnerability.

Remote Code Execution: The root build file pins log4j-core versions (2.14.1, 2.13.1) that are vulnerable to Log4Shell. Dependency management in pom.xml is a direct attack surface because any module inheriting these versions inherits the RCE risk.