CVE-2022-23307: A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

First published: Tue Jan 18 2022(Updated: )

A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized. Note this is the same as <a href="https://access.redhat.com/security/cve/CVE-2020-9493">CVE-2020-9493</a> which identified a deserialization issue in Apache Chainsaw. Prior to Chainsaw V2.0, Chainsaw was a component of Apache Log4j 1.2.x. References: <a href="https://www.openwall.com/lists/oss-security/2022/01/18/5">https://www.openwall.com/lists/oss-security/2022/01/18/5</a>

Credit: security@apache.org security@apache.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• collector/github-advisory-latest
• alias/GHSA-f7vh-qwp3-x37m
• alias/CVE-2022-23307
• collector/github-advisory
• zeroday/true
• agent/type
• agent/first-publish-date
• collector/launchpad-cve
• source/Launchpad
• agent/author
• agent/weakness
• agent/remedy
• agent/severity
• collector/nvd-index
• agent/software-canonical-lookup-request
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup
• collector/security-tracker-debian
• source/Debian
• collector/mitre-cve
• source/MITRE
• agent/title
• collector/ibm-support
• source/IBM
• collector/usn-cve
• source/Ubuntu
• agent/softwarecombine
• agent/description
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• agent/references
• agent/last-modified-date
• agent/tags
• agent/trending
• package-manager/redhat
• package-manager/maven
• vendor/apache
• canonical/apache log4j
• version/apache log4j/2.0-beta9
• version/apache log4j/2.15.0
• version/apache log4j/2.17.0
• version/apache log4j/1.2.x
• canonical/apache chainsaw
• version/apache log4j/1.2
• vendor/qos
• canonical/qos reload4j
• vendor/oracle
• canonical/oracle advanced supply chain planning
• version/oracle advanced supply chain planning/12.1
• version/oracle advanced supply chain planning/12.2
• canonical/oracle business intelligence
• version/oracle business intelligence/5.9.0.0.0
• version/oracle business intelligence/12.2.1.3.0
• version/oracle business intelligence/12.2.1.4.0
• canonical/oracle business process management suite
• version/oracle business process management suite/12.2.1.3.0
• version/oracle business process management suite/12.2.1.4.0
• canonical/oracle communications eagle ftp table base retrieval
• version/oracle communications eagle ftp table base retrieval/4.5
• canonical/oracle communications instant messaging server
• version/oracle communications instant messaging server/10.0.1.5.0
• canonical/oracle communications messaging server
• version/oracle communications messaging server/8.1
• canonical/oracle communications network integrity
• version/oracle communications network integrity/7.3.6
• canonical/oracle communications offline mediation controller
• version/oracle communications offline mediation controller/12.0.0.5.0
• canonical/oracle communications unified inventory management
• version/oracle communications unified inventory management/7.4.1
• version/oracle communications unified inventory management/7.4.2
• canonical/oracle e-business suite cloud manager and cloud backup module
• version/oracle e-business suite cloud manager and cloud backup module/2.2.1.1.1
• canonical/oracle enterprise manager base platform
• version/oracle enterprise manager base platform/13.4.0.0
• version/oracle enterprise manager base platform/13.5.0.0
• canonical/oracle financial services revenue management and billing analytics
• version/oracle financial services revenue management and billing analytics/2.7.0.0
• version/oracle financial services revenue management and billing analytics/2.7.0.1
• version/oracle financial services revenue management and billing analytics/2.8.0.0
• canonical/oracle healthcare foundation
• version/oracle healthcare foundation/8.1.0
• canonical/oracle hyperion data relationship management
• canonical/oracle hyperion infrastructure technology
• canonical/oracle identity management suite
• version/oracle identity management suite/12.2.1.3.0
• version/oracle identity management suite/12.2.1.4.0
• canonical/oracle identity manager connector
• version/oracle identity manager connector/11.1.1.5.0
• canonical/oracle jdeveloper
• version/oracle jdeveloper/12.2.1.3.0
• canonical/oracle middleware common libraries and tools
• version/oracle middleware common libraries and tools/12.2.1.4.0
• canonical/oracle mysql enterprise monitor
• version/oracle mysql enterprise monitor/8.0.29
• canonical/oracle retail extract transform and load
• version/oracle retail extract transform and load/13.2.5
• canonical/oracle tuxedo
• version/oracle tuxedo/12.2.2.0.0
• canonical/oracle weblogic server
• version/oracle weblogic server/12.2.1.3.0
• version/oracle weblogic server/12.2.1.4.0
• version/oracle weblogic server/14.1.1.0.0
• package-manager/debian
• vendor/ibm
• canonical/ibm qradar siem
• version/ibm qradar siem/7.5 - 7.5.0 up7