CVE-2020-9493: Java deserialization in Chainsaw

Reference Links

• http://www.openwall.com/lists/oss-security/2021/06/16/1
• http://www.openwall.com/lists/oss-security/2022/01/18/5
• https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83@%3Cannounce.apache.org%3E
• https://www.openwall.com/lists/oss-security/2021/06/16/1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/203829
• https://www.ibm.com/support/pages/node/7060803 (Advisory)
• https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83%40%3Cannounce.apache.org%3E

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7060803

Frequently Asked Questions

• What is CVE-2020-9493?

  CVE-2020-9493 is a deserialization flaw found in Apache Chainsaw versions prior to 2.1.0.

• How does CVE-2020-9493 pose a risk?

  CVE-2020-9493 allows a remote attacker to execute arbitrary code on the system through an unsafe deserialization flaw when reading log events.

• Which software versions are affected by CVE-2020-9493?

  Apache Chainsaw versions prior to 2.1.0, Apache Log4j versions between 1.2 and 2.0 (inclusive), Qos Reload4j versions prior to 1.2.18.1, and IBM QRadar SIEM versions up to 7.5.0 UP7 are affected by CVE-2020-9493.

• What is the severity of CVE-2020-9493?

  CVE-2020-9493 has a severity rating of 9.8 (Critical).

• How can CVE-2020-9493 be mitigated?

  To mitigate CVE-2020-9493, update Apache Chainsaw to version 2.1.0 or later, update Apache Log4j to a version higher than 2.0, update Qos Reload4j to version 1.2.18.1 or later, and update IBM QRadar SIEM to a version higher than 7.5.0 UP7.