REDHAT-BUG-2041967: High severity Apache Log4j vulnerability
A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized.
Note this is the same as CVE-2020-9493 which identified a deserialization issue in Apache Chainsaw. Prior to Chainsaw V2.0, Chainsaw was a component of Apache Log4j 1.2.x.
References:
https://www.openwall.com/lists/oss-security/2022/01/18/5
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2041967?
The severity of REDHAT-BUG-2041967 is considered high due to the deserialization flaw that can lead to remote code execution.
How do I fix REDHAT-BUG-2041967?
To fix REDHAT-BUG-2041967, upgrade Apache log4j to version 1.2.17 or later, which addresses the deserialization issue.
What versions of Apache log4j are affected by REDHAT-BUG-2041967?
Apache log4j versions 1.2.0 to 1.2.16 are affected by REDHAT-BUG-2041967.
Is REDHAT-BUG-2041967 related to any other vulnerabilities?
Yes, REDHAT-BUG-2041967 is related to CVE-2020-9493, which also identifies a deserialization issue in Apache Chainsaw.
What are the potential impacts of REDHAT-BUG-2041967?
The potential impacts of REDHAT-BUG-2041967 include data compromise and unauthorized command execution due to the deserialization flaw.