Red Hat Security Advisory

RHSA-2021:5206

log4j security update

Released 2021-12-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Client Optional (v. 7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server (v. 6 ELS) log4j-1.2.14-6.5.el6_10
Red Hat Enterprise Linux Server (v. 7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.3) log4j-1.2.17-16.el7_3
Red Hat Enterprise Linux Server AUS (v. 7.4) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.6) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server E4S (v. 7.6) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server E4S (v. 7.7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-javadoc-1.2.14-6.5.el6_10, log4j-manual-1.2.14-6.5.el6_10
Red Hat Enterprise Linux Server Optional (v. 7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-javadoc-1.2.17-16.el7_3, log4j-manual-1.2.17-16.el7_3
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4
Red Hat Enterprise Linux Server TUS (v. 7.6) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Server TUS (v. 7.7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Workstation (v. 7) log4j-1.2.17-17.el7_4
Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-javadoc-1.2.17-17.el7_4, log4j-manual-1.2.17-17.el7_4

Fixes 1 record

TI-2021-02983 CVE-2021-4104 · GHSA-fp5r-v3w9-4333

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

HIGH 73

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.80599 Published 2021-12-14 Partial fix CWE-502