Back Linuxsecurity # openSUSE 15.6 Log4j Security Vulnerability Report SUSE-SU-2026:0260
This update for log4j fixes the following issues: Security fixes: * CVE-2025-68161: Fixed absent TLS hostname verification that may allow a man- in-the-middle attack (bsc#1255427) Other fixes: * Upgrade to 2.18.0 * Added * Add support for Jakarta Mail API in the SMTP appender. * Add support for custom Log4j 1.x levels. * Add support for adding and retrieving appenders in Log4j 1.x bridge. * Add support for custom LMAX disruptor WaitStrategy configuration. * Add support for Apache Extras' RollingFileAppender in Log4j 1.x bridge. * Add MutableThreadContextMapFilter. * Add support for 24 colors in highlighting * Changed * Improves ServiceLoader support on servlet containers. * Make the default disruptor WaitStrategy used by Async Loggers garbage-free. * Do not throw UnsupportedOperationException when JUL ApiLogger::setLevel is called. * Support Spring 2.6.x. * Move perf tests to log4j-core-its * Upgrade the Flume Appender to
## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-254=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-254=1
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
zypper in -t patch openSUSE-SLE-15.6-2026-254=1
* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-254=1
* openSUSE Leap 15.6 (noarch) * log4j-slf4j-2.20.0-150200.4.30.1 * log4j-jcl-2.20.0-150200.4.30.1 * log4j-2.20.0-150200.4.30.1 * log4j-javadoc-2.20.0-150200.4.30.1 * Basesystem Module 15-SP7 (noarch) * log4j-slf4j-2.20.0-150200.4.30.1 * log4j-jcl-2.20.0-150200.4.30.1 * log4j-2.20.0-150200.4.30.1 * log4j-javadoc-2.20.0-150200.4.30.1
* openSUSE Leap 15.6 (noarch)
* log4j-slf4j-2.20.0-150200.4.30.1
* log4j-jcl-2.20.0-150200.4.30.1
* log4j-2.20.0-150200.4.30.1
* log4j-javadoc-2.20.0-150200.4.30.1
* Basesystem Module 15-SP7 (noarch)
* log4j-slf4j-2.20.0-150200.4.30.1
* log4j-jcl-2.20.0-150200.4.30.1
* log4j-2.20.0-150200.4.30.1
* log4j-javadoc-2.20.0-150200.4.30.1
* bsc#1255427 ## References: * *
*
*
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
