Red Hat Security Advisory

RHSA-2022:0442

log4j security update

Released 2022-02-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Client Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server (v. 6 ELS) log4j-1.2.14-6.6.el6_10
Red Hat Enterprise Linux Server (v. 7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.3) log4j-1.2.17-17.el7_3
Red Hat Enterprise Linux Server AUS (v. 7.4) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.6) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server AUS (v. 7.7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server E4S (v. 7.6) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server E4S (v. 7.7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-javadoc-1.2.14-6.6.el6_10, log4j-manual-1.2.14-6.6.el6_10
Red Hat Enterprise Linux Server Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-javadoc-1.2.17-17.el7_3, log4j-manual-1.2.17-17.el7_3
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
Red Hat Enterprise Linux Server TUS (v. 7.6) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Server TUS (v. 7.7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Workstation (v. 7) log4j-1.2.17-18.el7_4
Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4

Fixes 3 records

TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89

TI-2022-07425 CVE-2022-23302 · GHSA-w9p3-5cr8-m3jj

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

HIGH 76

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63841 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-502

TI-2022-07429 CVE-2022-23307 · GHSA-f7vh-qwp3-x37m

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

HIGH 73

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54411 Published 2022-01-18 Partial fix CWE-502