Red Hat Security Advisory

RHSA-2017:1417

rh-java-common-log4j security update

Released 2017-06-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7

Fixes 1 record

TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502