Red Hat Security Advisory

RHSA-2022:1299

Red Hat JBoss Enterprise Application Platform 7.4.4 security update

Released 2022-04-11 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar, org.jboss.logmanager.log4j-jboss-logmanager-1.2.2.Final-redhat-00002.jar

Fixes 7 records

TI-2021-20393 CVE-2021-45046 · GHSA-7rjr-3q55-vv33

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

CRITICAL 98KEV

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99977 Published 2021-12-14 Partial fix · 2.16.0, 2.12.2 +5 CWE-917

TI-2022-07428 CVE-2022-23305 · GHSA-65fg-84f6-3jq3

SQL injection in JDBC Appender in Apache Log4j V1

CRITICAL 85

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66537 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-89

TI-2022-07425 CVE-2022-23302 · GHSA-w9p3-5cr8-m3jj

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

HIGH 76

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63841 Published 2022-01-18 Partial fix · 2.0-alpha1 CWE-502

TI-2021-20283 CVE-2021-44832 · GHSA-8489-44mv-ggj8

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

HIGH 76

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data so…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.97906 Published 2021-12-28 Partial fix · 2.17.1, 2.3.2 +5 CWE-20

TI-2022-07429 CVE-2022-23307 · GHSA-f7vh-qwp3-x37m

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

HIGH 73

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54411 Published 2022-01-18 Partial fix CWE-502

TI-2021-02983 CVE-2021-4104 · GHSA-fp5r-v3w9-4333

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

HIGH 73

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.80599 Published 2021-12-14 Partial fix CWE-502

TI-2021-20437 CVE-2021-45105 · GHSA-p6xc-xr62-6r2g

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

HIGH 72

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.99999 Published 2021-12-18 Partial fix · 2.17.0, 2.12.3 +5 CWE-20