6

I want to intentionally install the old vulnerable version of the liblog4j2-java package in order to test the CVE-2021-44228 vulnerability. I'm using an Ubuntu machine.

I know I can list old package versions with apt-cache madison liblog4j2-java, but are these still vulnerable?

How can I download the old, but official packages?

1 Answer 1

9

The fixed packages are shipped in the updates and/or security repositories; the old, vulnerable packages are still available in the base repository. You can therefore install the latter by specifying the desired version:

  • in 18.04, sudo apt install liblog4j2-java=2.10.0-2;
  • in 20.04, sudo apt install liblog4j2-java=2.11.2-1;
  • in 21.04 and 21.10, sudo apt install liblog4j2-java=2.13.3-1.

The versions are shown by apt-cache madison.

Further reading: How to install specific Ubuntu packages, with exact version? and USN-5192-1: Apache Log4j 2 vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.