RHSA-2022:0438: Important: Red Hat JBoss Enterprise Application Platform 6.4 security update
First published: Thu Feb 03 2022(Updated: )
Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.<br>This asynchronous patch is an update for JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5, 6, and 7. All users of Red Hat JBoss Enterprise Application Platform 6.4 are advised to upgrade to this updated package.<br>Security Fix(es):<br><li> log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)</li> <li> log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)</li> <li> log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)</li> <li> log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/log4j-eap6 | <1.2.17-3.redhat_00008.1.ep6.el7 | 1.2.17-3.redhat_00008.1.ep6.el7 |
| redhat/log4j-jboss-logmanager | <1.1.4-3.Final_redhat_00002.1.ep6.el7 | 1.1.4-3.Final_redhat_00002.1.ep6.el7 |
| redhat/log4j-eap6 | <1.2.17-3.redhat_00008.1.ep6.el7 | 1.2.17-3.redhat_00008.1.ep6.el7 |
| redhat/log4j-jboss-logmanager | <1.1.4-3.Final_redhat_00002.1.ep6.el7 | 1.1.4-3.Final_redhat_00002.1.ep6.el7 |
| redhat/log4j-eap6 | <1.2.17-3.redhat_00008.1.ep6.el6 | 1.2.17-3.redhat_00008.1.ep6.el6 |
| redhat/log4j-jboss-logmanager | <1.1.4-3.Final_redhat_00002.1.ep6.el6 | 1.1.4-3.Final_redhat_00002.1.ep6.el6 |
| redhat/log4j-eap6 | <1.2.17-3.redhat_00008.1.ep6.el6 | 1.2.17-3.redhat_00008.1.ep6.el6 |
| redhat/log4j-jboss-logmanager | <1.1.4-3.Final_redhat_00002.1.ep6.el6 | 1.1.4-3.Final_redhat_00002.1.ep6.el6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2031667
- https://bugzilla.redhat.com/show_bug.cgi?id=2041949
- https://bugzilla.redhat.com/show_bug.cgi?id=2041959
- https://bugzilla.redhat.com/show_bug.cgi?id=2041967
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/
- https://access.redhat.com/errata/RHSA-2022:0438 (Advisory)
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2022:0438
- agent/software-canonical-lookup
- package-manager/redhat