Read the docs
TI-2022-07429 Aliases CVE-2022-23307GHSA-f7vh-qwp3-x37m

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Priority HIGH 73CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 55 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.54411 99th percentileScored 2026-11-07
Fix Partial Red Hat: 35 advisoriesRed Hat: 55 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4j 1.x1.2.1 and later; up to 2.0-alpha1—No fix listedCNA
—log4j:log4j (Maven)up to 1.2.17—No fix listedGHSA-f7vh-qwp3-x37m
—org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven)up to 2.0—No fix listedGHSA-f7vh-qwp3-x37m
  • Apache Log4j 1.x VendorApache Affected 1.2.1 and later; up to 2.0-alpha1 Fixed in — No fix listed CNA
  • log4j:log4j (Maven) Vendor— Affected up to 1.2.17 Fixed in — No fix listed GHSA-f7vh-qwp3-x37m
  • org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) Vendor— Affected up to 2.0 Fixed in — No fix listed GHSA-f7vh-qwp3-x37m

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:apache:chainsaw:*:*:*:*:*:*:*:*before 2.1.0VulnerableApache
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*1.2 to before 2.0VulnerableApache
cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:*before 1.2.18.1VulnerableQos
cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:*12.1VulnerableOracle
cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:*12.2VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*5.9.0.0.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:apache:chainsaw:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 1.2 to before 2.0 Vulnerable ·Apache
  • cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:* Versions before 1.2.18.1 Vulnerable ·Qos
  • cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* Versions 5.9.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*4.5VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*7.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*before 12.0.0.4.4VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableOracle
cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:*:*:*:*:*:*:*:*before 2.2.1.1.1VulnerableOracle
cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:*2.2.1.1.1VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*13.4.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*13.5.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:*2.7.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:*2.7.0.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:*2.8.0.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*before 11.2.8.0VulnerableOracle
cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:*before 11.2.8.0VulnerableOracle
cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*11.1.1.5.0VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.29VulnerableOracle
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:*13.2.5VulnerableOracle
cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:*12.2.2.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* Versions 7.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:* Versions before 12.0.0.4.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:*:*:*:*:*:*:*:* Versions before 2.2.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:* Versions 2.2.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* Versions 13.5.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:* Versions 2.7.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:* Versions 2.7.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:* Versions 2.8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:* Versions before 11.2.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:* Versions before 11.2.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:* Versions 11.1.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:* Versions 13.2.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:* Versions 12.2.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

Red Hat 35 advisories

  • RHSA-2024:10207 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.11 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2022:5460 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server jboss-as-appclient-7.5.24-2.Final_redhat_00001.1.ep6.el7, jboss-as-cli-7.5.24-2.Final_redhat_00001.1.ep6.el7, jboss-as-client-all-7.5.24-2.Final_redhat_00001.1.ep6.el7 +47
Show 32 more Red Hat advisories
  • RHSA-2022:5459 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-as-appclient-7.5.24-2.Final_redhat_00001.1.ep6.el6, jboss-as-cli-7.5.24-2.Final_redhat_00001.1.ep6.el6, jboss-as-client-all-7.5.24-2.Final_redhat_00001.1.ep6.el6 +47
  • RHSA-2022:5458 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • EAP 6.4.24 release
  • RHSA-2022:1299 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss Enterprise Application Platform org.apache.logging.log4j.log4j-api-2.17.1.redhat-00001.jar, org.jboss.logmanager.log4j-jboss-logmanager-1.2.2.Final-redhat-00002.jar
  • RHSA-2022:1297 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j-2.17.1-1.redhat_00001.1.el8eap
  • RHSA-2022:1296 Released 2022-04-11 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 7.4.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j-2.17.1-1.redhat_00001.1.el7eap
  • RHSA-2022:0661 Released 2022-02-23 · Red Hat rating Moderate
    Red Hat Fuse 7.10.1 release and security update
    • Red Hat Fuse 7.10.1
  • RHSA-2022:0553 Released 2022-02-15 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R20 security and bug fix update
    • Red Hat Fuse/AMQ 6.3.20
  • RHSA-2022:0527 Released 2022-02-14 · Red Hat rating Low
    Red Hat JBoss Web Server 3.1 Service Pack 14 security update
    • Red Hat JBoss Web Server 3.1
  • RHSA-2022:0524 Released 2022-02-14 · Red Hat rating Low
    Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update
    • Red Hat JBoss Web Server 3.1 for RHEL 7 log4j-eap6-1.2.17-3.redhat_00008.1.ep6.el7, tomcat-native-1.2.23-26.redhat_26.ep7.el7, tomcat7-7.0.70-46.ep7.el7 +23
  • RHSA-2022:0507 Released 2022-02-10 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8.SP2 security update
    • Red Hat JBoss Data Virtualization 6.4.8.SP2
  • RHSA-2022:0497 Released 2022-02-09 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8.SP1 security update
    • Red Hat JBoss Data Virtualization 6.4.8.SP1
  • RHSA-2022:0475 Released 2022-02-08 · Red Hat rating Low
    RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.10.6-0.1.el8ev, ovirt-engine-backend-4.4.10.6-0.1.el8ev, ovirt-engine-dbscripts-4.4.10.6-0.1.el8ev +19
  • RHSA-2022:0469 Released 2022-02-08 · Red Hat rating Important
    Red Hat AMQ Streams 2.0.1 release and security update
    • Red Hat AMQ Streams 2.0.1
  • RHSA-2022:0467 Released 2022-02-08 · Red Hat rating Important
    Red Hat AMQ Streams 1.6.7 release and security update
    • Red Hat AMQ Streams 1.6.7
  • RHSA-2022:0450 Released 2022-02-07 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle, rh-sso-7/sso75-openshift-rhel8
  • RHSA-2022:0445 Released 2022-02-07 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.10 on OpenJ9 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso74-openj9-openshift-rhel8
  • RHSA-2022:0447 Released 2022-02-07 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el7sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00003.1.el7sso
  • RHSA-2022:0448 Released 2022-02-07 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el8sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00003.1.el8sso
  • RHSA-2022:0449 Released 2022-02-07 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.1 security update
    • RHSSO 7.5.1
  • RHSA-2022:0446 Released 2022-02-07 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.10 security update
    • Red Hat Single Sign-On 7.4.10
  • RHSA-2022:0444 Released 2022-02-07 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.10 on OpenJDK for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8
  • RHSA-2022:0442 Released 2022-02-07 · Red Hat rating Important
    log4j security update
    • Red Hat Enterprise Linux Client (v. 7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Client Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server (v. 6 ELS) log4j-1.2.14-6.6.el6_10
    • Red Hat Enterprise Linux Server (v. 7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server AUS (v. 7.3) log4j-1.2.17-17.el7_3
    • Red Hat Enterprise Linux Server AUS (v. 7.4) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server AUS (v. 7.6) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server AUS (v. 7.7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server E4S (v. 7.6) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server E4S (v. 7.7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-javadoc-1.2.14-6.6.el6_10, log4j-manual-1.2.14-6.6.el6_10
    • Red Hat Enterprise Linux Server Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-javadoc-1.2.17-17.el7_3, log4j-manual-1.2.17-17.el7_3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server TUS (v. 7.6) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Server TUS (v. 7.7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Workstation (v. 7) log4j-1.2.17-18.el7_4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-javadoc-1.2.17-18.el7_4, log4j-manual-1.2.17-18.el7_4
  • RHSA-2022:0439 Released 2022-02-03 · Red Hat rating Important
    rh-maven36-log4j12 security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-log4j12-1.2.17-23.4.el7, rh-maven36-log4j12-javadoc-1.2.17-23.4.el7
    • Red Hat Software Collections for RHEL(v. 7) rh-maven36-log4j12-1.2.17-23.4.el7, rh-maven36-log4j12-javadoc-1.2.17-23.4.el7
  • RHSA-2022:0438 Released 2022-02-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server log4j-eap6-1.2.17-3.redhat_00008.1.ep6.el6, log4j-jboss-logmanager-1.1.4-3.Final_redhat_00002.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server log4j-eap6-1.2.17-3.redhat_00008.1.ep6.el7, log4j-jboss-logmanager-1.1.4-3.Final_redhat_00002.1.ep6.el7
  • RHSA-2022:0437 Released 2022-02-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • EAP 6.4 log4j async
  • RHSA-2022:0436 Released 2022-02-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j-jboss-logmanager-1.2.2-1.Final_redhat_00002.1.el7eap
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j-jboss-logmanager-1.2.2-1.Final_redhat_00002.1.el8eap
  • RHSA-2022:0435 Released 2022-02-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss Enterprise Application Platform org.jboss.logmanager.log4j-jboss-logmanager-1.2.2.Final-redhat-00002.jar
  • RHSA-2022:0430 Released 2022-02-03 · Red Hat rating Important
    Red Hat Data Grid 7.3.9 security update
    • Red Hat Data Grid 7.3.9
  • RHSA-2022:0289 Released 2022-01-26 · Red Hat rating Important
    parfait:0.5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) parfait-0.5.4-4.module+el8.4.0+13998+1b70e2b7.noarch::parfait:0.5, parfait-0.5.4-4.module+el8.4.0+13998+1b70e2b7.src::parfait:0.5, parfait-examples-0.5.4-4.module+el8.4.0+13998+1b70e2b7.noarch::parfait:0.5 +19
  • RHSA-2022:0291 Released 2022-01-26 · Red Hat rating Important
    parfait:0.5 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) parfait-0.5.4-4.module+el8.2.0+13999+fa2fb353.noarch::parfait:0.5, parfait-0.5.4-4.module+el8.2.0+13999+fa2fb353.src::parfait:0.5, parfait-examples-0.5.4-4.module+el8.2.0+13999+fa2fb353.noarch::parfait:0.5 +19
  • RHSA-2022:0290 Released 2022-01-26 · Red Hat rating Important
    parfait:0.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) parfait-0.5.4-4.module+el8.5.0+13988+de2b8c0b.noarch::parfait:0.5, parfait-0.5.4-4.module+el8.5.0+13988+de2b8c0b.src::parfait:0.5, parfait-examples-0.5.4-4.module+el8.5.0+13988+de2b8c0b.noarch::parfait:0.5 +19
  • RHSA-2022:0294 Released 2022-01-26 · Red Hat rating Important
    parfait:0.5 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) parfait-0.5.4-4.module+el8.1.0+14000+df5fdac7.noarch::parfait:0.5, parfait-0.5.4-4.module+el8.1.0+14000+df5fdac7.src::parfait:0.5, parfait-examples-0.5.4-4.module+el8.1.0+14000+df5fdac7.noarch::parfait:0.5 +19

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
EAP 6.4 log4j asyncFixed RHSA-2022:0437
EAP 6.4.24 releaseFixed RHSA-2022:5458
Middleware Containers for OpenShiftFixed RHSA-2022:0444, RHSA-2022:0445, RHSA-2022:0450
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:0475
RHSSO 7.5.1Fixed RHSA-2022:0449
Red Hat AMQ Streams 1.6.7Fixed RHSA-2022:0467
Red Hat AMQ Streams 2.0.1Fixed RHSA-2022:0469
Red Hat Data Grid 7.3.9Fixed RHSA-2022:0430
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:0290
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:0294
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:0291
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0289
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server AUS (v. 7.3)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server AUS (v. 7.4)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server AUS (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server AUS (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server E4S (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server E4S (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional AUS (v. 7.3)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional AUS (v. 7.4)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional AUS (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional AUS (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional E4S (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional E4S (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional TUS (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server Optional TUS (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server TUS (v. 7.6)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Server TUS (v. 7.7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:0442
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2022:0442
Red Hat Fuse 7.10.1Fixed RHSA-2022:0661
Red Hat Fuse/AMQ 6.3.20Fixed RHSA-2022:0553
Red Hat JBoss Data Virtualization 6.4.8.SP1Fixed RHSA-2022:0497
Red Hat JBoss Data Virtualization 6.4.8.SP2Fixed RHSA-2022:0507
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:0436, RHSA-2022:1296
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:0436, RHSA-2022:1297
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:0435
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2022:0438, RHSA-2022:5459
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2022:0438, RHSA-2022:5460
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2024:10207
Red Hat JBoss Web Server 3.1Fixed RHSA-2022:0527
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2022:0524
Red Hat Single Sign-On 7.4.10Fixed RHSA-2022:0446
Red Hat Single Sign-On 7.5 for RHEL 7 ServerFixed RHSA-2022:0447
Red Hat Single Sign-On 7.5 for RHEL 8Fixed RHSA-2022:0448
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0439
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0439
Not affected: 16 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Virtualization 4
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23307
  2. 2026-10-03 Alias added: GHSA-f7vh-qwp3-x37m
  3. 2026-10-14 EPSS moved to the 99th percentile and above

References

Patch 2

Advisory 3

  • TI-2020-07602 Java deserialization in Chainsaw CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences