Red Hat Security AdvisoryRHSA-2021:5269
rh-maven36-log4j12 security update
Released 2021-12-22 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-log4j12-1.2.17-23.3.el7, rh-maven36-log4j12-javadoc-1.2.17-23.3.el7
- Red Hat Software Collections for RHEL(v. 7) rh-maven36-log4j12-1.2.17-23.3.el7, rh-maven36-log4j12-javadoc-1.2.17-23.3.el7
Fixes 1 record
Priority HIGH 73
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.80599 · Published 2021-12-14 · Partial fix CWE-502
