rhsa-2022_0439
Vulnerability from csaf_redhat
Published
2022-02-03 19:09
Modified
2024-11-15 14:42
Summary
Red Hat Security Advisory: rh-maven36-log4j12 security update

Notes

Topic
An update for rh-maven36-log4j12 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fix(es): * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-maven36-log4j12 is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Log4j is a tool to help the programmer output log statements to a variety of output targets.\n\nSecurity Fix(es):\n\n* log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)\n\n* log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0439",
        "url": "https://access.redhat.com/errata/RHSA-2022:0439"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2041949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
      },
      {
        "category": "external",
        "summary": "2041959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
      },
      {
        "category": "external",
        "summary": "2041967",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0439.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-maven36-log4j12 security update",
    "tracking": {
      "current_release_date": "2024-11-15T14:42:13+00:00",
      "generator": {
        "date": "2024-11-15T14:42:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2022:0439",
      "initial_release_date": "2022-02-03T19:09:28+00:00",
      "revision_history": [
        {
          "date": "2022-02-03T19:09:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-03T19:09:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T14:42:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for RHEL Workstation(v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for RHEL Workstation(v. 7)",
                  "product_id": "7Server-RHSCL-3.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for RHEL(v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for RHEL(v. 7)",
                  "product_id": "7Workstation-RHSCL-3.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
                "product": {
                  "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
                  "product_id": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven36-log4j12@1.2.17-23.4.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
                "product": {
                  "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
                  "product_id": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven36-log4j12@1.2.17-23.4.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
                "product": {
                  "name": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
                  "product_id": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-maven36-log4j12-javadoc@1.2.17-23.4.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)",
          "product_id": "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch"
        },
        "product_reference": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)",
          "product_id": "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src"
        },
        "product_reference": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)",
          "product_id": "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
        },
        "product_reference": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)",
          "product_id": "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch"
        },
        "product_reference": "rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)",
          "product_id": "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src"
        },
        "product_reference": "rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)",
          "product_id": "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
        },
        "product_reference": "rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-23302",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this flaw ONLY affects applications which are specifically configured to use JMSSink, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSSink to the attacker\u0027s JNDI LDAP endpoint.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JMSSink is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23302",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/3",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/3"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-03T19:09:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0439"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSSink in the Log4j configuration if it is used\n- Remove the JMSSink class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSSink.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink"
    },
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JDBCAppender is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23305",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/4",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/4"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-03T19:09:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0439"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JDBCAppender in the Log4j configuration if it is used\n- Remove the JDBCAppender class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/jdbc/JDBCAppender.class\n```",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender"
    },
    {
      "cve": "CVE-2022-23307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041967"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Unsafe deserialization flaw in Chainsaw log viewer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Chainsaw is a standalone graphical user interface for viewing log entries in log4j. This flaw may be bypassed by using other available means to access log entries.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization ships a vulnerable version of the log4j package, however chainsaw is not part of typical use cases. An attacker looking to exploit this would need to not only be able to generate a malicious log entry, but also have the necessary access and permissions to start chainsaw on the engine node. Therefore the impact of this vulnerability for Red Hat Virtualization is rated Low.\n\nSimilar to Red Hat Virtualization in OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of log4j package, however vulnerable chainsaw component is not used by default. Therefore the impact to OCP is reduced to Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
          "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041967",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/5",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/5"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-03T19:09:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0439"
        },
        {
          "category": "workaround",
          "details": "These are the mitigations available for this flaw for log4j 1.x:\n- Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself.\n- Remove the Chainsaw classes from the log4j jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/chainsaw/*\n```\n(log4j jars may be nested in zip archives within product)",
          "product_ids": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Server-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.noarch",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-0:1.2.17-23.4.el7.src",
            "7Workstation-RHSCL-3.8:rh-maven36-log4j12-javadoc-0:1.2.17-23.4.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.