CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
First published: Tue Jan 18 2022(Updated: )
A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/log4j | <0:1.2.14-6.6.el6_10 | 0:1.2.14-6.6.el6_10 |
| redhat/log4j | <0:1.2.17-18.el7_4 | 0:1.2.17-18.el7_4 |
| redhat/log4j | <0:1.2.17-17.el7_3 | 0:1.2.17-17.el7_3 |
| redhat/log4j-eap6 | <0:1.2.17-3.redhat_00008.1.ep6.el6 | 0:1.2.17-3.redhat_00008.1.ep6.el6 |
| redhat/log4j-jboss-logmanager | <0:1.1.4-3.Final_redhat_00002.1.ep6.el6 | 0:1.1.4-3.Final_redhat_00002.1.ep6.el6 |
| redhat/jboss-as-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-bundles | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-cli | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-client-all | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-clustering | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-cmp | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-connector | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-controller-client | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-core | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-core-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-deployment-repository | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-deployment-scanner | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-domain | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-domain-http | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-domain-management | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ee | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ee-deployment | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ejb3 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-embedded | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-host-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jacorb | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-javadocs | <0:7.5.24-1.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-1.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jaxr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jaxrs | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jdr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jpa | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jsf | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jsr77 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-logging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-mail | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-management-client-content | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-messaging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-modcluster | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-modules-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-naming | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-network | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi-service | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-picketlink | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-platform-mbean | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-pojo | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-process-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-product-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-protocol | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-remoting | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-sar | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-server | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-standalone | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-system-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-threads | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-transactions | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-version | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-web | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-webservices | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-welcome-content-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-weld | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-xts | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossts | <1:4.17.45-2.Final_redhat_2.1.ep6.el6 | 1:4.17.45-2.Final_redhat_2.1.ep6.el6 |
| redhat/jbossweb | <0:7.5.32-2.Final_redhat_1.2.ep6.el6 | 0:7.5.32-2.Final_redhat_1.2.ep6.el6 |
| redhat/log4j-eap6 | <0:1.2.17-3.redhat_00008.1.ep6.el7 | 0:1.2.17-3.redhat_00008.1.ep6.el7 |
| redhat/log4j-jboss-logmanager | <0:1.1.4-3.Final_redhat_00002.1.ep6.el7 | 0:1.1.4-3.Final_redhat_00002.1.ep6.el7 |
| redhat/jboss-as-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-bundles | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-cli | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-client-all | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-clustering | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-cmp | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-connector | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-controller-client | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-core | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-core-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-deployment-repository | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-deployment-scanner | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-domain | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-domain-http | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-domain-management | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ee | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ee-deployment | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ejb3 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-embedded | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-host-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jacorb | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-javadocs | <0:7.5.24-1.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-1.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jaxr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jaxrs | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jdr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jpa | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jsf | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jsr77 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-logging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-mail | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-management-client-content | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-messaging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-modcluster | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-modules-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-naming | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-network | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi-service | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-picketlink | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-platform-mbean | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-pojo | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-process-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-product-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-protocol | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-remoting | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-sar | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-server | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-standalone | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-system-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-threads | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-transactions | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-version | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-web | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-webservices | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-welcome-content-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-weld | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-xts | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossts | <1:4.17.45-2.Final_redhat_2.1.ep6.el7 | 1:4.17.45-2.Final_redhat_2.1.ep6.el7 |
| redhat/jbossweb | <0:7.5.32-2.Final_redhat_1.2.ep6.el7 | 0:7.5.32-2.Final_redhat_1.2.ep6.el7 |
| redhat/eap7-log4j-jboss-logmanager | <0:1.2.2-1.Final_redhat_00002.1.el8ea | 0:1.2.2-1.Final_redhat_00002.1.el8ea |
| redhat/eap7-log4j | <0:2.17.1-1.redhat_00001.1.el8ea | 0:2.17.1-1.redhat_00001.1.el8ea |
| redhat/eap7-log4j-jboss-logmanager | <0:1.2.2-1.Final_redhat_00002.1.el7ea | 0:1.2.2-1.Final_redhat_00002.1.el7ea |
| redhat/eap7-log4j | <0:2.17.1-1.redhat_00001.1.el7ea | 0:2.17.1-1.redhat_00001.1.el7ea |
| redhat/tomcat7 | <0:7.0.70-46.ep7.el7 | 0:7.0.70-46.ep7.el7 |
| redhat/tomcat8 | <0:8.0.36-49.ep7.el7 | 0:8.0.36-49.ep7.el7 |
| redhat/tomcat-native | <0:1.2.23-26.redhat_26.ep7.el7 | 0:1.2.23-26.redhat_26.ep7.el7 |
| redhat/rh-sso7-keycloak | <0:15.0.4-1.redhat_00003.1.el7 | 0:15.0.4-1.redhat_00003.1.el7 |
| redhat/rh-sso7-keycloak | <0:15.0.4-1.redhat_00003.1.el8 | 0:15.0.4-1.redhat_00003.1.el8 |
| redhat/rh-maven36-log4j12 | <0:1.2.17-23.4.el7 | 0:1.2.17-23.4.el7 |
| redhat/snmp4j | <0:3.6.4-0.1.el8e | 0:3.6.4-0.1.el8e |
| redhat/redhat-sso | <7-sso75-openshift-rhel8 | 7-sso75-openshift-rhel8 |
| maven/org.zenframework.z8.dependencies.commons:log4j-1.2.17 | <=2.0 | |
| maven/log4j:log4j | <=1.2.17 | |
| Apache Log4j | =2.0-beta9 | |
| Apache Log4j | =2.15.0 | |
| Apache Log4j | =2.17.0 | |
| Apache Log4j | =1.2.x | |
| Apache Log4j | >=1.0.1<=1.2.17 | |
| Netapp Snapmanager Oracle | ||
| Netapp Snapmanager Sap | ||
| Broadcom Brocade Sannav | ||
| Qos Reload4j | <1.2.18.1 | |
| Oracle Advanced Supply Chain Planning | =12.1 | |
| Oracle Advanced Supply Chain Planning | =12.2 | |
| Oracle Business Intelligence | =5.9.0.0.0 | |
| Oracle Business Intelligence | =12.2.1.3.0 | |
| Oracle Business Intelligence | =12.2.1.4.0 | |
| Oracle Business Process Management Suite | =12.2.1.3.0 | |
| Oracle Business Process Management Suite | =12.2.1.4.0 | |
| Oracle Communications Eagle Ftp Table Base Retrieval | =4.5 | |
| Oracle Communications Instant Messaging Server | =10.0.1.5.0 | |
| Oracle Communications Messaging Server | =8.1 | |
| Oracle Communications Network Integrity | =7.3.6 | |
| Oracle Communications Offline Mediation Controller | <12.0.0.4.4 | |
| Oracle Communications Offline Mediation Controller | =12.0.0.5.0 | |
| Oracle Communications Unified Inventory Management | =7.4.1 | |
| Oracle Communications Unified Inventory Management | =7.4.2 | |
| Oracle E-business Suite Cloud Manager And Cloud Backup Module | <2.2.1.1.1 | |
| Oracle E-business Suite Cloud Manager And Cloud Backup Module | =2.2.1.1.1 | |
| Oracle Enterprise Manager Base Platform | =13.4.0.0 | |
| Oracle Enterprise Manager Base Platform | =13.5.0.0 | |
| Oracle Financial Services Revenue Management And Billing Analytics | =2.7.0.0 | |
| Oracle Financial Services Revenue Management And Billing Analytics | =2.7.0.1 | |
| Oracle Financial Services Revenue Management And Billing Analytics | =2.8.0.0 | |
| Oracle Healthcare Foundation | =8.1.0 | |
| Oracle Hyperion Data Relationship Management | <11.2.8.0 | |
| Oracle Hyperion Infrastructure Technology | <11.2.8.0 | |
| Oracle Identity Management Suite | =12.2.1.3.0 | |
| Oracle Identity Management Suite | =12.2.1.4.0 | |
| Oracle Identity Manager Connector | =11.1.1.5.0 | |
| Oracle JDeveloper | =12.2.1.3.0 | |
| Oracle Middleware Common Libraries And Tools | =12.2.1.4.0 | |
| Oracle Mysql Enterprise Monitor | <=8.0.29 | |
| Oracle Tuxedo | =12.2.2.0.0 | |
| Oracle WebLogic Server | =12.2.1.3.0 | |
| Oracle WebLogic Server | =12.2.1.4.0 | |
| Oracle WebLogic Server | =14.1.1.0.0 | |
| debian/apache-log4j1.2 | 1.2.17-10+deb11u1 1.2.17-11 | |
| IBM QRadar SIEM | <=7.5 - 7.5.0 UP7 |
Remedy
These are the possible mitigations for this flaw for releases version 1.x: - Comment out or remove JMSSink in the Log4j configuration if it is used - Remove the JMSSink class from the server's jar files. For example: ``` zip -q -d log4j-*.jar org/apache/log4j/net/JMSSink.class ``` - Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-23302 https://nvd.nist.gov/vuln/detail/CVE-2022-23302 https://www.openwall.com/lists/oss-security/2022/01/18/3
- https://bugzilla.redhat.com/show_bug.cgi?id=2041949
- https://access.redhat.com/errata/RHSA-2022:5458
- https://access.redhat.com/errata/RHSA-2022:1299
- https://access.redhat.com/errata/RHSA-2022:0435
- https://access.redhat.com/errata/RHSA-2022:0467
- https://access.redhat.com/errata/RHSA-2022:0469
- https://access.redhat.com/errata/RHSA-2022:0442
- https://access.redhat.com/errata/RHSA-2022:0290
- https://access.redhat.com/errata/RHSA-2022:0294
- https://access.redhat.com/errata/RHSA-2022:0291
- https://access.redhat.com/errata/RHSA-2022:0289
- https://access.redhat.com/errata/RHSA-2022:0553
- https://access.redhat.com/errata/RHSA-2022:0430
- https://access.redhat.com/errata/RHSA-2022:0497
- https://access.redhat.com/errata/RHSA-2022:0507
- https://access.redhat.com/errata/RHSA-2022:0437
- https://access.redhat.com/errata/RHSA-2022:0438
- https://access.redhat.com/errata/RHSA-2022:5459
- https://access.redhat.com/errata/RHSA-2022:5460
- https://access.redhat.com/errata/RHSA-2022:0436
- https://access.redhat.com/errata/RHSA-2022:1297
- https://access.redhat.com/errata/RHSA-2022:1296
- https://access.redhat.com/errata/RHSA-2022:0661
- https://access.redhat.com/errata/RHSA-2022:0527
- https://access.redhat.com/errata/RHSA-2022:0524
- https://access.redhat.com/errata/RHSA-2022:0446
- https://access.redhat.com/errata/RHSA-2022:0447
- https://access.redhat.com/errata/RHSA-2022:0448
- https://access.redhat.com/errata/RHSA-2022:0439
- https://access.redhat.com/errata/RHSA-2022:0475
- https://access.redhat.com/errata/RHSA-2022:0450
- https://access.redhat.com/errata/RHSA-2022:0449
- https://access.redhat.com/security/cve/cve-2022-23302
- https://nvd.nist.gov/vuln/detail/CVE-2022-23302
- https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w
- https://logging.apache.org/log4j/1.2/index.html
- https://security.netapp.com/advisory/ntap-20220217-0006/
- http://www.openwall.com/lists/oss-security/2022/01/18/3
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/advisories/GHSA-w9p3-5cr8-m3jj (Advisory)
- https://launchpad.net/bugs/cve/CVE-2022-23302
- https://www.openwall.com/lists/oss-security/2022/01/18/3
- https://security-tracker.debian.org/tracker/CVE-2022-23302
- https://access.redhat.com/security/cve/CVE-2021-4104
- https://access.redhat.com/errata/RHSA-2022:0444
- https://access.redhat.com/errata/RHSA-2022:0445
- https://access.redhat.com/errata/RHSA-2024:5856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/217460
- https://www.ibm.com/support/pages/node/7060803 (Advisory)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302
- https://ubuntu.com/security/CVE-2022-23302
- https://www.theregister.com/2024/10/08/patch_tuesday_october_2024/
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2022:5458
- RHSA-2022:1299
- RHSA-2022:0435
- RHSA-2022:0467
- RHSA-2022:0469
- RHSA-2022:0442
- RHSA-2022:0290
- RHSA-2022:0294
- RHSA-2022:0291
- RHSA-2022:0289
- RHSA-2022:0553
- RHSA-2022:0430
- RHSA-2022:0497
- RHSA-2022:0507
- RHSA-2022:0437
- RHSA-2022:0438
- RHSA-2022:5459
- RHSA-2022:5460
- RHSA-2022:0436
- RHSA-2022:1297
- RHSA-2022:1296
- RHSA-2022:0661
- RHSA-2022:0527
- RHSA-2022:0524
- RHSA-2022:0446
- RHSA-2022:0447
- RHSA-2022:0448
- RHSA-2022:0439
- RHSA-2022:0475
- RHSA-2022:0450
- RHSA-2022:0449
- IBM-7060803
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- collector/redhat-cve
- collector/github-advisory-latest
- alias/GHSA-w9p3-5cr8-m3jj
- alias/CVE-2022-23302
- collector/github-advisory
- zeroday/true
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/remedy
- agent/severity
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/the-register
- source/The Register
- alias/CVE-2024-43572
- alias/CVE-2024-43573
- alias/CVE-2024-6197
- alias/CVE-2024-43583
- alias/CVE-2024-20659
- alias/CVE-2024-43468
- alias/CVE-2024-38124
- alias/CVE-2024-41730
- package-manager/redhat
- package-manager/maven
- vendor/apache
- canonical/apache log4j
- version/apache log4j/2.0-beta9
- version/apache log4j/2.15.0
- version/apache log4j/2.17.0
- version/apache log4j/1.2.x
- version/apache log4j/1.0.1
- version/apache log4j/1.2.17
- vendor/netapp
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- vendor/broadcom
- canonical/broadcom brocade sannav
- vendor/qos
- canonical/qos reload4j
- vendor/oracle
- canonical/oracle advanced supply chain planning
- version/oracle advanced supply chain planning/12.1
- version/oracle advanced supply chain planning/12.2
- canonical/oracle business intelligence
- version/oracle business intelligence/5.9.0.0.0
- version/oracle business intelligence/12.2.1.3.0
- version/oracle business intelligence/12.2.1.4.0
- canonical/oracle business process management suite
- version/oracle business process management suite/12.2.1.3.0
- version/oracle business process management suite/12.2.1.4.0
- canonical/oracle communications eagle ftp table base retrieval
- version/oracle communications eagle ftp table base retrieval/4.5
- canonical/oracle communications instant messaging server
- version/oracle communications instant messaging server/10.0.1.5.0
- canonical/oracle communications messaging server
- version/oracle communications messaging server/8.1
- canonical/oracle communications network integrity
- version/oracle communications network integrity/7.3.6
- canonical/oracle communications offline mediation controller
- version/oracle communications offline mediation controller/12.0.0.5.0
- canonical/oracle communications unified inventory management
- version/oracle communications unified inventory management/7.4.1
- version/oracle communications unified inventory management/7.4.2
- canonical/oracle e-business suite cloud manager and cloud backup module
- version/oracle e-business suite cloud manager and cloud backup module/2.2.1.1.1
- canonical/oracle enterprise manager base platform
- version/oracle enterprise manager base platform/13.4.0.0
- version/oracle enterprise manager base platform/13.5.0.0
- canonical/oracle financial services revenue management and billing analytics
- version/oracle financial services revenue management and billing analytics/2.7.0.0
- version/oracle financial services revenue management and billing analytics/2.7.0.1
- version/oracle financial services revenue management and billing analytics/2.8.0.0
- canonical/oracle healthcare foundation
- version/oracle healthcare foundation/8.1.0
- canonical/oracle hyperion data relationship management
- canonical/oracle hyperion infrastructure technology
- canonical/oracle identity management suite
- version/oracle identity management suite/12.2.1.3.0
- version/oracle identity management suite/12.2.1.4.0
- canonical/oracle identity manager connector
- version/oracle identity manager connector/11.1.1.5.0
- canonical/oracle jdeveloper
- version/oracle jdeveloper/12.2.1.3.0
- canonical/oracle middleware common libraries and tools
- version/oracle middleware common libraries and tools/12.2.1.4.0
- canonical/oracle mysql enterprise monitor
- version/oracle mysql enterprise monitor/8.0.29
- canonical/oracle tuxedo
- version/oracle tuxedo/12.2.2.0.0
- canonical/oracle weblogic server
- version/oracle weblogic server/12.2.1.3.0
- version/oracle weblogic server/12.2.1.4.0
- version/oracle weblogic server/14.1.1.0.0
- package-manager/debian
- vendor/ibm
- canonical/ibm qradar siem
- version/ibm qradar siem/7.5 - 7.5.0 up7