Read the docs
Red Hat Security Advisory

RHSA-2022:0467

Red Hat AMQ Streams 1.6.7 release and security update

Released 2022-02-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

Priority CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89
TI-2022-07425 CVE-2022-23302 · GHSA-w9p3-5cr8-m3jj

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

Priority HIGH 76

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63841 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-502
TI-2021-20283 CVE-2021-44832 · GHSA-8489-44mv-ggj8

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Priority HIGH 76

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data so…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.97906 Published 2021-12-28 Partial fix · 2.17.1, 2.3.2 +5 CWE-20
TI-2021-03045 CVE-2021-4178 · GHSA-98g7-rxmf-rrxm

Deserialization of untrusted data in kubernetes-client

Priority LOW 30

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00335 Published 2022-08-24 Partial fix · 5.0.3, 5.1.2 +5 CWE-502