The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5020 advisory.

    Chen Zhaojun of Alibaba Cloud Security Team discovered a critical security vulnerability in Apache Log4j,     a popular Logging Framework for Java. JNDI features used in configuration, log messages, and parameters do     not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control     log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message     lookup substitution is enabled. From version 2.15.0, this behavior has been disabled by default. This     update also fixes CVE-2020-9488 in the oldstable distribution (buster). Improper validation of certificate     with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted     by a man-in-the-middle attack which could leak any log messages sent through that appender. For the     oldstable distribution (buster), this problem has been fixed in version 2.15.0-1~deb10u1. For the stable     distribution (bullseye), this problem has been fixed in version 2.15.0-1~deb11u1. We recommend that you     upgrade your apache-log4j2 packages. For the detailed security status of apache-log4j2 please refer to its     security tracker page at: https://security-tracker.debian.org/tracker/apache-log4j2

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5020-1 : apache-log4j2 - security update

critical Nessus Plugin ID 156015

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.12 Jan 24, 2025, 9:25 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202501242125
Version 1.11 Feb 17, 2023, 11:41 PM CEA reference Plugin Feed: 202302172341
Version 1.10 Jan 17, 2023, 4:54 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301171654
Version 1.9 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254