Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-17571 (GCVE-0-2019-17571)
Vulnerability from cvelistv5 – Published: 2019-12-20 16:01 – Updated: 2024-08-05 01:40
VLAI
EPSS
Summary
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Severity
No CVSS data available.
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
113 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Log4j |
Affected:
versions up to 1.2.17
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.836Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"name": "openSUSE-SU-2020:0051",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"name": "[tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[jena-dev] 20200318 Re: Logging (JENA-1005)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E"
},
{
"name": "[druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "DSA-4686",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"name": "[kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "[kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Assigned] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "USN-4495-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"name": "[zookeeper-dev] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Resolved] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "[kafka-users] 20210210 Security: CVE-2019-17571 (log4j)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20210211 [GitHub] [kafka] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"name": "[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2534) Log4j flagged as critical security violation",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210611 Re: [DISCUSS] KIP-719: Add Log4J2 Appender",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "[kafka-users] 20210617 vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[portals-pluto-scm] 20210629 [portals-pluto] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Closed] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[activemq-users] 20210830 Security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210831 RE: Security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211013 [GitHub] [bookkeeper] eolivelli commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-commits] 20211014 [bookkeeper] branch master updated: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571 (#2816)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211016 [GitHub] [bookkeeper] pkumar-singh commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] zymap commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211018 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Log4j",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "versions up to 1.2.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T16:12:31.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"name": "[activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"name": "openSUSE-SU-2020:0051",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"name": "[tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[jena-dev] 20200318 Re: Logging (JENA-1005)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E"
},
{
"name": "[druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "DSA-4686",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"name": "[kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "[kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Assigned] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "USN-4495-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"name": "[zookeeper-dev] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Resolved] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "[kafka-users] 20210210 Security: CVE-2019-17571 (log4j)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20210211 [GitHub] [kafka] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E"
},
{
"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"name": "[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2534) Log4j flagged as critical security violation",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210611 Re: [DISCUSS] KIP-719: Add Log4J2 Appender",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "[kafka-users] 20210617 vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[portals-pluto-scm] 20210629 [portals-pluto] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Closed] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[activemq-users] 20210830 Security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210831 RE: Security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211013 [GitHub] [bookkeeper] eolivelli commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-commits] 20211014 [bookkeeper] branch master updated: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571 (#2816)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211016 [GitHub] [bookkeeper] pkumar-singh commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] zymap commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211018 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-17571",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Log4j",
"version": {
"version_data": [
{
"version_value": "versions up to 1.2.17"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502: Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E"
},
{
"name": "[activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"name": "openSUSE-SU-2020:0051",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"name": "[tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[jena-dev] 20200318 Re: Logging (JENA-1005)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E"
},
{
"name": "[druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E"
},
{
"name": "DSA-4686",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"name": "[kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "[kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E",
"refsource": "CONFIRM",
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200110-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Assigned] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "USN-4495-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"name": "[zookeeper-dev] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Resolved] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "[kafka-users] 20210210 Security: CVE-2019-17571 (log4j)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20210211 [GitHub] [kafka] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"name": "[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2534) Log4j flagged as critical security violation",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210611 Re: [DISCUSS] KIP-719: Add Log4J2 Appender",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "[kafka-users] 20210617 vulnerabilities",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[portals-pluto-scm] 20210629 [portals-pluto] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Closed] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[activemq-users] 20210830 Security issues",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210831 RE: Security issues",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211013 [GitHub] [bookkeeper] eolivelli commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-commits] 20211014 [bookkeeper] branch master updated: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571 (#2816)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211016 [GitHub] [bookkeeper] pkumar-singh commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] zymap commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211018 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2019-17571",
"datePublished": "2019-12-20T16:01:21.000Z",
"dateReserved": "2019-10-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:40:15.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-17571",
"date": "2026-05-27",
"epss": "0.33799",
"percentile": "0.97023"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-17571\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2019-12-20T17:15:11.893\",\"lastModified\":\"2024-11-21T04:32:33.393\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.\"},{\"lang\":\"es\",\"value\":\"Incluido en Log4j versi\u00f3n 1.2 existe una clase SocketServer que es vulnerable a la deserializaci\u00f3n de datos no confiables, que pueden ser explotada para ejecutar c\u00f3digo arbitrario remotamente cuando se combina con un dispositivo de deserializaci\u00f3n al escuchar el tr\u00e1fico de red no confiable para datos de registro. Esto afecta a Log4j versiones desde 1.2 hasta 1.2.17.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.17\",\"matchCriteriaId\":\"362179E0-FF81-4DED-B456-552615222A8C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndIncluding\":\"3.1.3\",\"matchCriteriaId\":\"B9273745-6408-4CD3-94E8-9385D4F5FE69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5735E553-9731-4AAC-BCFF-989377F817B3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A125E817-F974-4509-872C-B71933F42AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.3.2\",\"versionEndIncluding\":\"7.3.6\",\"matchCriteriaId\":\"ABD748C9-24F6-4739-9772-208B98616EE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D03A8C9-35A5-4B75-9711-7A4A60457307\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndIncluding\":\"14.8.0\",\"matchCriteriaId\":\"2959030B-A9B7-4423-A2E8-9352FC83C4A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"317CA916-61F3-4E24-B42F-610A1C88A5BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.29\",\"matchCriteriaId\":\"B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.2\",\"versionEndIncluding\":\"16.2.11\",\"matchCriteriaId\":\"1CB8F81A-D028-4258-9A4F-ADEE25BE95FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.12.0\",\"versionEndIncluding\":\"17.12.7\",\"matchCriteriaId\":\"E4AA3854-C9FD-4287-85A0-EE7907D1E1ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"19A0F1AF-F2E6-44E7-8E2D-190E103B72D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D53690D-3390-4A27-988A-709CD89DD05B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E306B67-E1BD-4A67-A77D-A7DC72D5B957\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"378A6656-252B-4929-83EA-BC107FDFD357\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"363395FA-C296-4B2B-9D6F-BCB8DBE6FACE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F62A2144-5EF8-4319-B8C2-D7975F51E5FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B40B13B7-68B3-4510-968C-6A730EB46462\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C93CC705-1F8C-4870-99E6-14BF264C3811\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F14A818F-AA16-4438-A3E4-E64C9287AC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.3\",\"matchCriteriaId\":\"8AF2C94A-428B-47AF-B0A5-09EFB109941C\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200110-0001/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4495-1/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4686\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200110-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4495-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4686\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
}
}
FKIE_CVE-2019-17571
Vulnerability from fkie_nvd - Published: 2019-12-20 17:15 - Updated: 2024-11-21 04:32
Severity
Summary
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | log4j | * | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| canonical | ubuntu_linux | 18.04 | |
| opensuse | leap | 15.1 | |
| netapp | oncommand_system_manager | * | |
| netapp | oncommand_workflow_automation | - | |
| oracle | application_testing_suite | 13.3.0.1 | |
| oracle | communications_network_integrity | * | |
| oracle | endeca_information_discovery_studio | 3.2.0 | |
| oracle | financial_services_lending_and_leasing | * | |
| oracle | financial_services_lending_and_leasing | 12.5.0 | |
| oracle | mysql_enterprise_monitor | * | |
| oracle | primavera_gateway | * | |
| oracle | primavera_gateway | * | |
| oracle | rapid_planning | 12.1 | |
| oracle | rapid_planning | 12.2 | |
| oracle | retail_extract_transform_and_load | 19.0 | |
| oracle | retail_service_backbone | 14.1 | |
| oracle | retail_service_backbone | 15.0 | |
| oracle | retail_service_backbone | 16.0 | |
| oracle | weblogic_server | 10.3.6.0.0 | |
| oracle | weblogic_server | 12.1.3.0.0 | |
| oracle | weblogic_server | 12.2.1.3.0 | |
| oracle | weblogic_server | 12.2.1.4.0 | |
| oracle | weblogic_server | 14.1.1.0.0 | |
| apache | bookkeeper | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
"matchCriteriaId": "362179E0-FF81-4DED-B456-552615222A8C",
"versionEndIncluding": "1.2.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9273745-6408-4CD3-94E8-9385D4F5FE69",
"versionEndIncluding": "3.1.3",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A125E817-F974-4509-872C-B71933F42AD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABD748C9-24F6-4739-9772-208B98616EE2",
"versionEndIncluding": "7.3.6",
"versionStartIncluding": "7.3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9D03A8C9-35A5-4B75-9711-7A4A60457307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2959030B-A9B7-4423-A2E8-9352FC83C4A2",
"versionEndIncluding": "14.8.0",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "317CA916-61F3-4E24-B42F-610A1C88A5BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747",
"versionEndIncluding": "8.0.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1CB8F81A-D028-4258-9A4F-ADEE25BE95FC",
"versionEndIncluding": "16.2.11",
"versionStartIncluding": "16.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4AA3854-C9FD-4287-85A0-EE7907D1E1ED",
"versionEndIncluding": "17.12.7",
"versionStartIncluding": "17.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "19A0F1AF-F2E6-44E7-8E2D-190E103B72D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6D53690D-3390-4A27-988A-709CD89DD05B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4E306B67-E1BD-4A67-A77D-A7DC72D5B957",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "378A6656-252B-4929-83EA-BC107FDFD357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "363395FA-C296-4B2B-9D6F-BCB8DBE6FACE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F62A2144-5EF8-4319-B8C2-D7975F51E5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B40B13B7-68B3-4510-968C-6A730EB46462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C93CC705-1F8C-4870-99E6-14BF264C3811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F14A818F-AA16-4438-A3E4-E64C9287AC66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04BCDC24-4A21-473C-8733-0D9CFB38A752",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8AF2C94A-428B-47AF-B0A5-09EFB109941C",
"versionEndExcluding": "4.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."
},
{
"lang": "es",
"value": "Incluido en Log4j versi\u00f3n 1.2 existe una clase SocketServer que es vulnerable a la deserializaci\u00f3n de datos no confiables, que pueden ser explotada para ejecutar c\u00f3digo arbitrario remotamente cuando se combina con un dispositivo de deserializaci\u00f3n al escuchar el tr\u00e1fico de red no confiable para datos de registro. Esto afecta a Log4j versiones desde 1.2 hasta 1.2.17."
}
],
"id": "CVE-2019-17571",
"lastModified": "2024-11-21T04:32:33.393",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-20T17:15:11.893",
"references": [
{
"source": "security@apache.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "security@apache.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"sourceIdentifier": "security@apache.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "security@apache.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-2QRG-X229-3V8Q
Vulnerability from github – Published: 2020-01-06 18:43 – Updated: 2023-05-24 20:58
VLAI
Summary
Deserialization of Untrusted Data in Log4j
Details
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.
Users are advised to migrate to org.apache.logging.log4j:log4j-core.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "log4j:log4j"
},
"ranges": [
{
"events": [
{
"introduced": "1.2"
},
{
"last_affected": "1.2.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.zenframework.z8.dependencies.commons:log4j-1.2.17"
},
"versions": [
"2.0"
]
}
],
"aliases": [
"CVE-2019-17571"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2019-12-27T22:02:37Z",
"nvd_published_at": "2019-12-20T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.\n\nUsers are advised to migrate to `org.apache.logging.log4j:log4j-core`.",
"id": "GHSA-2qrg-x229-3v8q",
"modified": "2023-05-24T20:58:14Z",
"published": "2020-01-06T18:43:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4495-1"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200110-0001"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Deserialization of Untrusted Data in Log4j"
}
GSD-2019-17571
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-17571",
"description": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
"id": "GSD-2019-17571",
"references": [
"https://www.suse.com/security/cve/CVE-2019-17571.html",
"https://www.debian.org/security/2020/dsa-4686",
"https://access.redhat.com/errata/RHSA-2022:0507",
"https://access.redhat.com/errata/RHSA-2022:0497",
"https://access.redhat.com/errata/RHSA-2019:1545",
"https://access.redhat.com/errata/RHSA-2017:3400",
"https://access.redhat.com/errata/RHSA-2017:3399",
"https://access.redhat.com/errata/RHSA-2017:3244",
"https://access.redhat.com/errata/RHSA-2017:2889",
"https://access.redhat.com/errata/RHSA-2017:2888",
"https://access.redhat.com/errata/RHSA-2017:2811",
"https://access.redhat.com/errata/RHSA-2017:2810",
"https://access.redhat.com/errata/RHSA-2017:2638",
"https://access.redhat.com/errata/RHSA-2017:2633",
"https://access.redhat.com/errata/RHSA-2017:2423",
"https://access.redhat.com/errata/RHSA-2017:1802",
"https://access.redhat.com/errata/RHSA-2017:1801",
"https://ubuntu.com/security/CVE-2019-17571",
"https://alas.aws.amazon.com/cve/html/CVE-2019-17571.html",
"https://access.redhat.com/errata/RHSA-2022:5053"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-17571"
],
"details": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
"id": "GSD-2019-17571",
"modified": "2023-12-13T01:23:44.795711Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-17571",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Log4j",
"version": {
"version_data": [
{
"version_value": "versions up to 1.2.17"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502: Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E"
},
{
"name": "[activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"name": "openSUSE-SU-2020:0051",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"name": "[tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[jena-dev] 20200318 Re: Logging (JENA-1005)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E"
},
{
"name": "[druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E"
},
{
"name": "DSA-4686",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"name": "[kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "[kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E",
"refsource": "CONFIRM",
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200110-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Assigned] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "USN-4495-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"name": "[zookeeper-dev] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Resolved] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "[kafka-users] 20210210 Security: CVE-2019-17571 (log4j)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20210211 [GitHub] [kafka] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"name": "[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2534) Log4j flagged as critical security violation",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210611 Re: [DISCUSS] KIP-719: Add Log4J2 Appender",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "[kafka-users] 20210617 vulnerabilities",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[portals-pluto-scm] 20210629 [portals-pluto] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Closed] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[activemq-users] 20210830 Security issues",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210831 RE: Security issues",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211013 [GitHub] [bookkeeper] eolivelli commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-commits] 20211014 [bookkeeper] branch master updated: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571 (#2816)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211016 [GitHub] [bookkeeper] pkumar-singh commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] zymap commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211018 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[1.2,1.2.17]",
"affected_versions": "All versions starting from 1.2 up to 1.2.17",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-502",
"CWE-937"
],
"date": "2020-01-06",
"description": "Included in Log4j is a `SocketServer` class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.",
"fixed_versions": [
"2.0-alpha1"
],
"identifier": "CVE-2019-17571",
"identifiers": [
"CVE-2019-17571"
],
"not_impacted": "All versions before 1.2, all versions after 1.2.17",
"package_slug": "maven/log4j/log4j",
"pubdate": "2019-12-20",
"solution": "Upgrade to version 2.0-alpha1 or above.",
"title": "Deserialization of Untrusted Data",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
],
"uuid": "a540ae5f-a9e4-4a14-bfcd-646017451348"
},
{
"affected_range": "[1.2,1.2.17]",
"affected_versions": "All versions starting from 1.2 up to 1.2.17",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-502",
"CWE-937"
],
"date": "2020-01-06",
"description": "Included in Log4j is a `SocketServer` class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.",
"fixed_versions": [
"2.0-alpha1"
],
"identifier": "CVE-2019-17571",
"identifiers": [
"CVE-2019-17571"
],
"not_impacted": "All versions before 1.2, all versions after 1.2.17",
"package_slug": "maven/org.apache.logging.log4j/log4j",
"pubdate": "2019-12-20",
"solution": "Upgrade to version 2.0-alpha1 or above.",
"title": "Deserialization of Untrusted Data",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
],
"uuid": "1ccaac07-05d1-4a08-8482-0ae7d8ceb029"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.2.17",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.1.3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "14.8.0",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.3.6",
"versionStartIncluding": "7.3.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "16.2.11",
"versionStartIncluding": "16.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "17.12.7",
"versionStartIncluding": "17.12.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.29",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.14.3",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-17571"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E",
"refsource": "CONFIRM",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E"
},
{
"name": "[kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200110-0001/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
},
{
"name": "[tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
},
{
"name": "openSUSE-SU-2020:0051",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
},
{
"name": "[tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E"
},
{
"name": "[tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
"refsource": "MLIST",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[jena-dev] 20200318 Re: Logging (JENA-1005)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E"
},
{
"name": "[druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E"
},
{
"name": "[kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E"
},
{
"name": "DSA-4686",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4686"
},
{
"name": "[kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Assigned] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20200824 [jira] [Comment Edited] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "USN-4495-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4495-1/"
},
{
"name": "[zookeeper-dev] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Created] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[zookeeper-issues] 20201103 [jira] [Resolved] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E"
},
{
"name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "[kafka-users] 20210210 Security: CVE-2019-17571 (log4j)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-jira] 20210211 [GitHub] [kafka] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E"
},
{
"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"name": "[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2534) Log4j flagged as critical security violation",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-dev] 20210611 Re: [DISCUSS] KIP-719: Add Log4J2 Appender",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "[kafka-users] 20210617 vulnerabilities",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Closed] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-scm] 20210629 [portals-pluto] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[portals-pluto-dev] 20210629 [jira] [Updated] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E"
},
{
"name": "[activemq-users] 20210830 Security issues",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[activemq-users] 20210831 RE: Security issues",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E"
},
{
"name": "[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
},
{
"name": "[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
},
{
"name": "[hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] RaulGracia opened a new pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211006 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211007 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211013 [GitHub] [bookkeeper] eolivelli commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-commits] 20211014 [bookkeeper] branch master updated: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571 (#2816)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211016 [GitHub] [bookkeeper] pkumar-singh commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] eolivelli commented on a change in pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211017 [GitHub] [bookkeeper] zymap commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "[bookkeeper-issues] 20211018 [GitHub] [bookkeeper] RaulGracia commented on pull request #2816: Issue 2815: Upgrade to log4j2 to get rid of CVE-2019-17571",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-12-14T17:50Z",
"publishedDate": "2019-12-20T17:15Z"
}
}
}
NCSC-2026-0091
Vulnerability from csaf_ncscnl - Published: 2026-03-12 07:24 - Updated: 2026-03-12 07:24Summary
Kwetsbaarheden verholpen in SAP-producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: SAP heeft kwetsbaarheden verholpen in verschillende producten, waaronder SAP Quotation Management Insurance en SAP NetWeaver. Een deel van de verholpen kwetsbaarheden bevind zich in producten van derde partijen - zoals Oracle - die verwerkt zitten in SAP producten.
Interpretaties: De kwetsbaarheden omvatten onder andere een code-injectie flaw, ontbrekende autorisatiecontroles, Denial of Service, een DOM-gebaseerde Cross-Site Scripting (XSS) en onjuist beheer van gevoelige informatie. Deze kwetsbaarheden kunnen worden misbruikt om toegang te krijgen tot gevoelige informatie, ongeautoriseerde wijzigingen aan te brengen of zelfs code-uitvoering te veroorzaken. De kwetsbaarheden hebben invloed op de beschikbaarheid, vertrouwelijkheid en integriteit van de systemen, afhankelijk van de specifieke kwetsbaarheid.
Oplossingen: SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-125: Out-of-bounds Read
CWE-312: Cleartext Storage of Sensitive Information
CWE-427: Uncontrolled Search Path Element
CWE-502: Deserialization of Untrusted Data
CWE-606: Unchecked Input for Loop Condition
CWE-787: Out-of-bounds Write
CWE-862: Missing Authorization
CWE-918: Server-Side Request Forgery (SSRF)
Multiple critical vulnerabilities affect Oracle Fusion Middleware, Oracle Communications Unified Assurance, Oracle Application Testing Suite, SAP Quotation Management Insurance, and Apache Log4j 1.2, enabling remote unauthenticated attackers to execute arbitrary code and fully compromise systems.
9.8 (Critical)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
Multiple OpenSSL versions have an out-of-bounds read/write vulnerability in RFC 3211 KEK unwrap related to password-based CMS decryption, with moderate severity due to low exploit likelihood, affecting products including NetApp, Oracle, and SAP components.
7.5 (High)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
A low-severity out-of-bounds read vulnerability in OpenSSL HTTP client API occurs when the 'no_proxy' environment variable is set and the HTTP URL contains an IPv6 address, causing denial of service via application crash in multiple products including Oracle PeopleSoft and NetApp devices.
5.9 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An unauthenticated attacker can exploit insufficient input validation in SAP Business One Job Service's URL query parameter to trigger a DOM-based Cross-Site Scripting (XSS) vulnerability affecting confidentiality and integrity.
6.1 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An authenticated attacker can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to modify database configuration tables, potentially degrading system performance or causing interruptions without compromising confidentiality.
6.4 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An authenticated attacker can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to execute certain function modules and access sensitive database catalog information, impacting confidentiality with low severity.
CWE-862 - Missing AuthorizationAffected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
SAP Customer Checkout 2.0 suffers from an Insecure Storage Protection vulnerability where operational data is stored locally with reversible protection, allowing user modifications without validation that may affect system behavior, confidentiality, and integrity.
5.6 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
The SAP Solution Tools Plug-In (ST-PI) contains a vulnerability due to a missing authorization check in a function module, potentially exposing system information with low confidentiality impact and no effect on integrity or availability.
5.0 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
SAP NetWeaver Application Server for ABAP contains a vulnerable ABAP Report that can perform HTTP requests to arbitrary endpoints, enabling low-impact Server-Side Request Forgery (SSRF) attacks that may expose internal systems.
6.4 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
SAP GUI for Windows contains a DLL hijacking vulnerability that permits unauthenticated attackers to execute malicious code by placing a malicious DLL in specific directories, with limited impact when GuiXT is enabled.
5.0 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows authenticated attackers to inject arbitrary SQL code via unvalidated inputs, potentially leading to unauthorized database access with low confidentiality and availability impact.
6.4 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
SAP NetWeaver Enterprise Portal Administration contains an insecure deserialization vulnerability that can be exploited by a privileged user uploading malicious content, leading to significant security risks.
9.1 (Critical)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An authenticated attacker can exploit a missing authorization check vulnerability in SAP Business Warehouse's Service API to perform unauthorized configuration changes, potentially causing denial of service with high availability impact.
5.9 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
A missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal allows high-privilege users to access sensitive data across companies, compromising data confidentiality.
5.8 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An authenticated user with privileges can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to read Database Analyzer Log Files via a specific RFC function module, impacting confidentiality without affecting integrity or availability.
5.0 (Medium)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
An authenticated attacker can exploit a Denial of Service vulnerability in SAP Supply Chain Management by invoking a remote function module with a large loop-control parameter, causing excessive resource consumption and potential system unavailability.
7.7 (High)
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Application Server for ABAP
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Enterprise Portal Administration
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA HCM Portugal, ERP HCM Portugal
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Supply Chain Management
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business One (Job Service)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Business Warehouse (Service API)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP GUI for Windows with active GuiXT
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Feedback Notification)
|
vers:unknown/* |
References
17 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft kwetsbaarheden verholpen in verschillende producten, waaronder SAP Quotation Management Insurance en SAP NetWeaver. Een deel van de verholpen kwetsbaarheden bevind zich in producten van derde partijen - zoals Oracle - die verwerkt zitten in SAP producten.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten onder andere een code-injectie flaw, ontbrekende autorisatiecontroles, Denial of Service, een DOM-gebaseerde Cross-Site Scripting (XSS) en onjuist beheer van gevoelige informatie. Deze kwetsbaarheden kunnen worden misbruikt om toegang te krijgen tot gevoelige informatie, ongeautoriseerde wijzigingen aan te brengen of zelfs code-uitvoering te veroorzaken. De kwetsbaarheden hebben invloed op de beschikbaarheid, vertrouwelijkheid en integriteit van de systemen, afhankelijk van de specifieke kwetsbaarheid.\n",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "general",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2026.html"
}
],
"title": "Kwetsbaarheden verholpen in SAP-producten",
"tracking": {
"current_release_date": "2026-03-12T07:24:16.575638Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0091",
"initial_release_date": "2026-03-12T07:24:16.575638Z",
"revision_history": [
{
"date": "2026-03-12T07:24:16.575638Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "NetWeaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "NetWeaver Application Server for ABAP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "NetWeaver Enterprise Portal Administration"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "S4HANA HCM Portugal, ERP HCM Portugal"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Supply Chain Management"
}
],
"category": "vendor",
"name": "SAP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "SAP Business One (Job Service)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "SAP Business Warehouse (Service API)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "SAP GUI for Windows with active GuiXT"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (Feedback Notification)"
}
],
"category": "vendor",
"name": "SAP_SE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-17571",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "Multiple critical vulnerabilities affect Oracle Fusion Middleware, Oracle Communications Unified Assurance, Oracle Application Testing Suite, SAP Quotation Management Insurance, and Apache Log4j 1.2, enabling remote unauthenticated attackers to execute arbitrary code and fully compromise systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2019-17571 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-17571.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2019-17571"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Multiple OpenSSL versions have an out-of-bounds read/write vulnerability in RFC 3211 KEK unwrap related to password-based CMS decryption, with moderate severity due to low exploit likelihood, affecting products including NetApp, Oracle, and SAP components.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-9230 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9230.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2025-9230"
},
{
"cve": "CVE-2025-9232",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "A low-severity out-of-bounds read vulnerability in OpenSSL HTTP client API occurs when the \u0027no_proxy\u0027 environment variable is set and the HTTP URL contains an IPv6 address, causing denial of service via application crash in multiple products including Oracle PeopleSoft and NetApp devices.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-9232 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9232.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2025-9232"
},
{
"cve": "CVE-2026-0489",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "description",
"text": "An unauthenticated attacker can exploit insufficient input validation in SAP Business One Job Service\u0027s URL query parameter to trigger a DOM-based Cross-Site Scripting (XSS) vulnerability affecting confidentiality and integrity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-0489 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0489.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-0489"
},
{
"cve": "CVE-2026-24309",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "An authenticated attacker can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to modify database configuration tables, potentially degrading system performance or causing interruptions without compromising confidentiality.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24309 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24309.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24309"
},
{
"cve": "CVE-2026-24310",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "An authenticated attacker can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to execute certain function modules and access sensitive database catalog information, impacting confidentiality with low severity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24310 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24310.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24310"
},
{
"cve": "CVE-2026-24311",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "description",
"text": "SAP Customer Checkout 2.0 suffers from an Insecure Storage Protection vulnerability where operational data is stored locally with reversible protection, allowing user modifications without validation that may affect system behavior, confidentiality, and integrity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24311 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24311.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24311"
},
{
"cve": "CVE-2026-24313",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "The SAP Solution Tools Plug-In (ST-PI) contains a vulnerability due to a missing authorization check in a function module, potentially exposing system information with low confidentiality impact and no effect on integrity or availability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24313 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24313.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24313"
},
{
"cve": "CVE-2026-24316",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "description",
"text": "SAP NetWeaver Application Server for ABAP contains a vulnerable ABAP Report that can perform HTTP requests to arbitrary endpoints, enabling low-impact Server-Side Request Forgery (SSRF) attacks that may expose internal systems.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24316 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24316.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24316"
},
{
"cve": "CVE-2026-24317",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "description",
"text": "SAP GUI for Windows contains a DLL hijacking vulnerability that permits unauthenticated attackers to execute malicious code by placing a malicious DLL in specific directories, with limited impact when GuiXT is enabled.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24317 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24317.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-24317"
},
{
"cve": "CVE-2026-27684",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "description",
"text": "SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows authenticated attackers to inject arbitrary SQL code via unvalidated inputs, potentially leading to unauthorized database access with low confidentiality and availability impact.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27684 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27684.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27684"
},
{
"cve": "CVE-2026-27685",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "SAP NetWeaver Enterprise Portal Administration contains an insecure deserialization vulnerability that can be exploited by a privileged user uploading malicious content, leading to significant security risks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27685 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27685.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27685"
},
{
"cve": "CVE-2026-27686",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "An authenticated attacker can exploit a missing authorization check vulnerability in SAP Business Warehouse\u0027s Service API to perform unauthorized configuration changes, potentially causing denial of service with high availability impact.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27686 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27686.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27686"
},
{
"cve": "CVE-2026-27687",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "A missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal allows high-privilege users to access sensitive data across companies, compromising data confidentiality.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27687 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27687.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27687"
},
{
"cve": "CVE-2026-27688",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "An authenticated user with privileges can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to read Database Analyzer Log Files via a specific RFC function module, impacting confidentiality without affecting integrity or availability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27688 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27688.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27688"
},
{
"cve": "CVE-2026-27689",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"notes": [
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "description",
"text": "An authenticated attacker can exploit a Denial of Service vulnerability in SAP Supply Chain Management by invoking a remote function module with a large loop-control parameter, causing excessive resource consumption and potential system unavailability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27689 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27689.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9"
]
}
],
"title": "CVE-2026-27689"
}
]
}
OPENSUSE-SU-2020:0051-1
Vulnerability from csaf_opensuse - Published: 2020-01-14 13:15 - Updated: 2020-01-14 13:15Summary
Security update for log4j
Severity
Important
Notes
Title of the patch: Security update for log4j
Description of the patch: This update for log4j fixes the following issues:
- CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames: openSUSE-2020-51
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
critical
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for log4j",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for log4j fixes the following issues:\n\n- CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-51",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0051-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0051-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HDETB2O74FUPCJP3O342H6HHPPLG7ZA/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0051-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HDETB2O74FUPCJP3O342H6HHPPLG7ZA/"
},
{
"category": "self",
"summary": "SUSE Bug 1159646",
"url": "https://bugzilla.suse.com/1159646"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17571 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17571/"
}
],
"title": "Security update for log4j",
"tracking": {
"current_release_date": "2020-01-14T13:15:52Z",
"generator": {
"date": "2020-01-14T13:15:52Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0051-1",
"initial_release_date": "2020-01-14T13:15:52Z",
"revision_history": [
{
"date": "2020-01-14T13:15:52Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "log4j-1.2.17-lp151.5.3.1.noarch",
"product": {
"name": "log4j-1.2.17-lp151.5.3.1.noarch",
"product_id": "log4j-1.2.17-lp151.5.3.1.noarch"
}
},
{
"category": "product_version",
"name": "log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"product": {
"name": "log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"product_id": "log4j-javadoc-1.2.17-lp151.5.3.1.noarch"
}
},
{
"category": "product_version",
"name": "log4j-manual-1.2.17-lp151.5.3.1.noarch",
"product": {
"name": "log4j-manual-1.2.17-lp151.5.3.1.noarch",
"product_id": "log4j-manual-1.2.17-lp151.5.3.1.noarch"
}
},
{
"category": "product_version",
"name": "log4j-mini-1.2.17-lp151.5.3.1.noarch",
"product": {
"name": "log4j-mini-1.2.17-lp151.5.3.1.noarch",
"product_id": "log4j-mini-1.2.17-lp151.5.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-1.2.17-lp151.5.3.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1.noarch"
},
"product_reference": "log4j-1.2.17-lp151.5.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-1.2.17-lp151.5.3.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1.noarch"
},
"product_reference": "log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-1.2.17-lp151.5.3.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1.noarch"
},
"product_reference": "log4j-manual-1.2.17-lp151.5.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-mini-1.2.17-lp151.5.3.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1.noarch"
},
"product_reference": "log4j-mini-1.2.17-lp151.5.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-17571",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17571"
}
],
"notes": [
{
"category": "general",
"text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17571",
"url": "https://www.suse.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "SUSE Bug 1159646 for CVE-2019-17571",
"url": "https://bugzilla.suse.com/1159646"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:log4j-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-javadoc-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-manual-1.2.17-lp151.5.3.1.noarch",
"openSUSE Leap 15.1:log4j-mini-1.2.17-lp151.5.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-14T13:15:52Z",
"details": "critical"
}
],
"title": "CVE-2019-17571"
}
]
}
OPENSUSE-SU-2024:11025-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
log4j-2.13.2-1.9 on GA media
Severity
Moderate
Notes
Title of the patch: log4j-2.13.2-1.9 on GA media
Description of the patch: These are all security issues fixed in the log4j-2.13.2-1.9 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-11025
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "log4j-2.13.2-1.9 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the log4j-2.13.2-1.9 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11025",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11025-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17571 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17571/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-9488 page",
"url": "https://www.suse.com/security/cve/CVE-2020-9488/"
}
],
"title": "log4j-2.13.2-1.9 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11025-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "log4j-2.13.2-1.9.aarch64",
"product": {
"name": "log4j-2.13.2-1.9.aarch64",
"product_id": "log4j-2.13.2-1.9.aarch64"
}
},
{
"category": "product_version",
"name": "log4j-javadoc-2.13.2-1.9.aarch64",
"product": {
"name": "log4j-javadoc-2.13.2-1.9.aarch64",
"product_id": "log4j-javadoc-2.13.2-1.9.aarch64"
}
},
{
"category": "product_version",
"name": "log4j-jcl-2.13.2-1.9.aarch64",
"product": {
"name": "log4j-jcl-2.13.2-1.9.aarch64",
"product_id": "log4j-jcl-2.13.2-1.9.aarch64"
}
},
{
"category": "product_version",
"name": "log4j-slf4j-2.13.2-1.9.aarch64",
"product": {
"name": "log4j-slf4j-2.13.2-1.9.aarch64",
"product_id": "log4j-slf4j-2.13.2-1.9.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-2.13.2-1.9.ppc64le",
"product": {
"name": "log4j-2.13.2-1.9.ppc64le",
"product_id": "log4j-2.13.2-1.9.ppc64le"
}
},
{
"category": "product_version",
"name": "log4j-javadoc-2.13.2-1.9.ppc64le",
"product": {
"name": "log4j-javadoc-2.13.2-1.9.ppc64le",
"product_id": "log4j-javadoc-2.13.2-1.9.ppc64le"
}
},
{
"category": "product_version",
"name": "log4j-jcl-2.13.2-1.9.ppc64le",
"product": {
"name": "log4j-jcl-2.13.2-1.9.ppc64le",
"product_id": "log4j-jcl-2.13.2-1.9.ppc64le"
}
},
{
"category": "product_version",
"name": "log4j-slf4j-2.13.2-1.9.ppc64le",
"product": {
"name": "log4j-slf4j-2.13.2-1.9.ppc64le",
"product_id": "log4j-slf4j-2.13.2-1.9.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-2.13.2-1.9.s390x",
"product": {
"name": "log4j-2.13.2-1.9.s390x",
"product_id": "log4j-2.13.2-1.9.s390x"
}
},
{
"category": "product_version",
"name": "log4j-javadoc-2.13.2-1.9.s390x",
"product": {
"name": "log4j-javadoc-2.13.2-1.9.s390x",
"product_id": "log4j-javadoc-2.13.2-1.9.s390x"
}
},
{
"category": "product_version",
"name": "log4j-jcl-2.13.2-1.9.s390x",
"product": {
"name": "log4j-jcl-2.13.2-1.9.s390x",
"product_id": "log4j-jcl-2.13.2-1.9.s390x"
}
},
{
"category": "product_version",
"name": "log4j-slf4j-2.13.2-1.9.s390x",
"product": {
"name": "log4j-slf4j-2.13.2-1.9.s390x",
"product_id": "log4j-slf4j-2.13.2-1.9.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-2.13.2-1.9.x86_64",
"product": {
"name": "log4j-2.13.2-1.9.x86_64",
"product_id": "log4j-2.13.2-1.9.x86_64"
}
},
{
"category": "product_version",
"name": "log4j-javadoc-2.13.2-1.9.x86_64",
"product": {
"name": "log4j-javadoc-2.13.2-1.9.x86_64",
"product_id": "log4j-javadoc-2.13.2-1.9.x86_64"
}
},
{
"category": "product_version",
"name": "log4j-jcl-2.13.2-1.9.x86_64",
"product": {
"name": "log4j-jcl-2.13.2-1.9.x86_64",
"product_id": "log4j-jcl-2.13.2-1.9.x86_64"
}
},
{
"category": "product_version",
"name": "log4j-slf4j-2.13.2-1.9.x86_64",
"product": {
"name": "log4j-slf4j-2.13.2-1.9.x86_64",
"product_id": "log4j-slf4j-2.13.2-1.9.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-2.13.2-1.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64"
},
"product_reference": "log4j-2.13.2-1.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-2.13.2-1.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le"
},
"product_reference": "log4j-2.13.2-1.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-2.13.2-1.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x"
},
"product_reference": "log4j-2.13.2-1.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-2.13.2-1.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64"
},
"product_reference": "log4j-2.13.2-1.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-2.13.2-1.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64"
},
"product_reference": "log4j-javadoc-2.13.2-1.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-2.13.2-1.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le"
},
"product_reference": "log4j-javadoc-2.13.2-1.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-2.13.2-1.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x"
},
"product_reference": "log4j-javadoc-2.13.2-1.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-2.13.2-1.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64"
},
"product_reference": "log4j-javadoc-2.13.2-1.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-jcl-2.13.2-1.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64"
},
"product_reference": "log4j-jcl-2.13.2-1.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-jcl-2.13.2-1.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le"
},
"product_reference": "log4j-jcl-2.13.2-1.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-jcl-2.13.2-1.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x"
},
"product_reference": "log4j-jcl-2.13.2-1.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-jcl-2.13.2-1.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64"
},
"product_reference": "log4j-jcl-2.13.2-1.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-slf4j-2.13.2-1.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64"
},
"product_reference": "log4j-slf4j-2.13.2-1.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-slf4j-2.13.2-1.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le"
},
"product_reference": "log4j-slf4j-2.13.2-1.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-slf4j-2.13.2-1.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x"
},
"product_reference": "log4j-slf4j-2.13.2-1.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-slf4j-2.13.2-1.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
},
"product_reference": "log4j-slf4j-2.13.2-1.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-17571",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17571"
}
],
"notes": [
{
"category": "general",
"text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17571",
"url": "https://www.suse.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "SUSE Bug 1159646 for CVE-2019-17571",
"url": "https://bugzilla.suse.com/1159646"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2019-17571"
},
{
"cve": "CVE-2020-9488",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-9488"
}
],
"notes": [
{
"category": "general",
"text": "Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-9488",
"url": "https://www.suse.com/security/cve/CVE-2020-9488"
},
{
"category": "external",
"summary": "SUSE Bug 1170535 for CVE-2020-9488",
"url": "https://bugzilla.suse.com/1170535"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:log4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-javadoc-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-jcl-2.13.2-1.9.x86_64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.aarch64",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.ppc64le",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.s390x",
"openSUSE Tumbleweed:log4j-slf4j-2.13.2-1.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2020-9488"
}
]
}
OPENSUSE-SU-2024:11026-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
log4j12-1.2.17-3.9 on GA media
Severity
Moderate
Notes
Title of the patch: log4j12-1.2.17-3.9 on GA media
Description of the patch: These are all security issues fixed in the log4j12-1.2.17-3.9 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-11026
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "log4j12-1.2.17-3.9 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the log4j12-1.2.17-3.9 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11026",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11026-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5645 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5645/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17571 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17571/"
}
],
"title": "log4j12-1.2.17-3.9 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11026-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "log4j12-1.2.17-3.9.aarch64",
"product": {
"name": "log4j12-1.2.17-3.9.aarch64",
"product_id": "log4j12-1.2.17-3.9.aarch64"
}
},
{
"category": "product_version",
"name": "log4j12-javadoc-1.2.17-3.9.aarch64",
"product": {
"name": "log4j12-javadoc-1.2.17-3.9.aarch64",
"product_id": "log4j12-javadoc-1.2.17-3.9.aarch64"
}
},
{
"category": "product_version",
"name": "log4j12-manual-1.2.17-3.9.aarch64",
"product": {
"name": "log4j12-manual-1.2.17-3.9.aarch64",
"product_id": "log4j12-manual-1.2.17-3.9.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j12-1.2.17-3.9.ppc64le",
"product": {
"name": "log4j12-1.2.17-3.9.ppc64le",
"product_id": "log4j12-1.2.17-3.9.ppc64le"
}
},
{
"category": "product_version",
"name": "log4j12-javadoc-1.2.17-3.9.ppc64le",
"product": {
"name": "log4j12-javadoc-1.2.17-3.9.ppc64le",
"product_id": "log4j12-javadoc-1.2.17-3.9.ppc64le"
}
},
{
"category": "product_version",
"name": "log4j12-manual-1.2.17-3.9.ppc64le",
"product": {
"name": "log4j12-manual-1.2.17-3.9.ppc64le",
"product_id": "log4j12-manual-1.2.17-3.9.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j12-1.2.17-3.9.s390x",
"product": {
"name": "log4j12-1.2.17-3.9.s390x",
"product_id": "log4j12-1.2.17-3.9.s390x"
}
},
{
"category": "product_version",
"name": "log4j12-javadoc-1.2.17-3.9.s390x",
"product": {
"name": "log4j12-javadoc-1.2.17-3.9.s390x",
"product_id": "log4j12-javadoc-1.2.17-3.9.s390x"
}
},
{
"category": "product_version",
"name": "log4j12-manual-1.2.17-3.9.s390x",
"product": {
"name": "log4j12-manual-1.2.17-3.9.s390x",
"product_id": "log4j12-manual-1.2.17-3.9.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j12-1.2.17-3.9.x86_64",
"product": {
"name": "log4j12-1.2.17-3.9.x86_64",
"product_id": "log4j12-1.2.17-3.9.x86_64"
}
},
{
"category": "product_version",
"name": "log4j12-javadoc-1.2.17-3.9.x86_64",
"product": {
"name": "log4j12-javadoc-1.2.17-3.9.x86_64",
"product_id": "log4j12-javadoc-1.2.17-3.9.x86_64"
}
},
{
"category": "product_version",
"name": "log4j12-manual-1.2.17-3.9.x86_64",
"product": {
"name": "log4j12-manual-1.2.17-3.9.x86_64",
"product_id": "log4j12-manual-1.2.17-3.9.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-1.2.17-3.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64"
},
"product_reference": "log4j12-1.2.17-3.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-1.2.17-3.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le"
},
"product_reference": "log4j12-1.2.17-3.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-1.2.17-3.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x"
},
"product_reference": "log4j12-1.2.17-3.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-1.2.17-3.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64"
},
"product_reference": "log4j12-1.2.17-3.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-javadoc-1.2.17-3.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64"
},
"product_reference": "log4j12-javadoc-1.2.17-3.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-javadoc-1.2.17-3.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le"
},
"product_reference": "log4j12-javadoc-1.2.17-3.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-javadoc-1.2.17-3.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x"
},
"product_reference": "log4j12-javadoc-1.2.17-3.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-javadoc-1.2.17-3.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64"
},
"product_reference": "log4j12-javadoc-1.2.17-3.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-manual-1.2.17-3.9.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64"
},
"product_reference": "log4j12-manual-1.2.17-3.9.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-manual-1.2.17-3.9.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le"
},
"product_reference": "log4j12-manual-1.2.17-3.9.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-manual-1.2.17-3.9.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x"
},
"product_reference": "log4j12-manual-1.2.17-3.9.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j12-manual-1.2.17-3.9.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
},
"product_reference": "log4j12-manual-1.2.17-3.9.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-5645",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5645"
}
],
"notes": [
{
"category": "general",
"text": "In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5645",
"url": "https://www.suse.com/security/cve/CVE-2017-5645"
},
{
"category": "external",
"summary": "SUSE Bug 1034569 for CVE-2017-5645",
"url": "https://bugzilla.suse.com/1034569"
},
{
"category": "external",
"summary": "SUSE Bug 1159646 for CVE-2017-5645",
"url": "https://bugzilla.suse.com/1159646"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-5645"
},
{
"cve": "CVE-2019-17571",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17571"
}
],
"notes": [
{
"category": "general",
"text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17571",
"url": "https://www.suse.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "SUSE Bug 1159646 for CVE-2019-17571",
"url": "https://bugzilla.suse.com/1159646"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-javadoc-1.2.17-3.9.x86_64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.aarch64",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.ppc64le",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.s390x",
"openSUSE Tumbleweed:log4j12-manual-1.2.17-3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2019-17571"
}
]
}
RHSA-2017:1801
Vulnerability from csaf_redhat - Published: 2017-07-25 16:44 - Updated: 2026-05-14 22:23Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update
Severity
Important
Notes
Topic: An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)
* A vulnerability was discovered in tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)
* A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)
* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.
7.5 (High)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.
5.5 (Medium)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
7.5 (High)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
8.1 (High)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure.
7.5 (High)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application.
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.
7.5 (High)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches.
5.9 (Medium)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.
9.8 (Critical)
Affected products
Fixed
64 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
59 references
Acknowledgments
the OpenSSL project
Gear Team of Qihoo 360 Inc.
Shi Lei
Gear Team of Qihoo 360 Inc.
Shi Lei
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)\n\n* A vulnerability was discovered in tomcat\u0027s handling of pipelined requests when \"Sendfile\" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)\n\n* A vulnerability was discovered in the error page mechanism in Tomcat\u0027s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)\n\n* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1801",
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1441205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441205"
},
{
"category": "external",
"summary": "1441223",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441223"
},
{
"category": "external",
"summary": "1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "external",
"summary": "1459158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459158"
},
{
"category": "external",
"summary": "JWS-657",
"url": "https://issues.redhat.com/browse/JWS-657"
},
{
"category": "external",
"summary": "JWS-667",
"url": "https://issues.redhat.com/browse/JWS-667"
},
{
"category": "external",
"summary": "JWS-695",
"url": "https://issues.redhat.com/browse/JWS-695"
},
{
"category": "external",
"summary": "JWS-709",
"url": "https://issues.redhat.com/browse/JWS-709"
},
{
"category": "external",
"summary": "JWS-716",
"url": "https://issues.redhat.com/browse/JWS-716"
},
{
"category": "external",
"summary": "JWS-717",
"url": "https://issues.redhat.com/browse/JWS-717"
},
{
"category": "external",
"summary": "JWS-725",
"url": "https://issues.redhat.com/browse/JWS-725"
},
{
"category": "external",
"summary": "JWS-741",
"url": "https://issues.redhat.com/browse/JWS-741"
},
{
"category": "external",
"summary": "JWS-760",
"url": "https://issues.redhat.com/browse/JWS-760"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1801.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update",
"tracking": {
"current_release_date": "2026-05-14T22:23:33+00:00",
"generator": {
"date": "2026-05-14T22:23:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2017:1801",
"initial_release_date": "2017-07-25T16:44:35+00:00",
"revision_history": [
{
"date": "2017-07-25T16:44:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-07-25T16:44:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:23:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1 for RHEL 7",
"product": {
"name": "Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1 for RHEL 6",
"product": {
"name": "Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product_id": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.8-10.redhat_10.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product_id": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.2.8-10.redhat_10.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product_id": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.8-10.redhat_10.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product_id": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.2.8-10.redhat_10.ep7.el6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"product": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"product_id": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.8-10.redhat_10.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"product": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"product_id": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-eap6@1.2.16-12.redhat_3.1.ep6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.70-22.ep7.el7.src",
"product": {
"name": "tomcat7-0:7.0.70-22.ep7.el7.src",
"product_id": "tomcat7-0:7.0.70-22.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.70-22.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.36-24.ep7.el7.src",
"product": {
"name": "tomcat8-0:8.0.36-24.ep7.el7.src",
"product_id": "tomcat8-0:8.0.36-24.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.36-24.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"product": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"product_id": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.8-10.redhat_10.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"product": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"product_id": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-eap6@1.2.16-12.redhat_3.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.36-24.ep7.el6.src",
"product": {
"name": "tomcat8-0:8.0.36-24.ep7.el6.src",
"product_id": "tomcat8-0:8.0.36-24.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.36-24.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.70-22.ep7.el6.src",
"product": {
"name": "tomcat7-0:7.0.70-22.ep7.el6.src",
"product_id": "tomcat7-0:7.0.70-22.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.70-22.ep7.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"product": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"product_id": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-eap6@1.2.16-12.redhat_3.1.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsvc@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-selinux@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"product_id": "tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.70-22.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-selinux@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsvc@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"product_id": "tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.36-24.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"product": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"product_id": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-eap6@1.2.16-12.redhat_3.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-selinux@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsvc@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"product_id": "tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.36-24.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsvc@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-selinux@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.70-22.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.70-22.ep7.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product_id": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.8-10.redhat_10.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product_id": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.2.8-10.redhat_10.ep7.el6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch"
},
"product_reference": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src"
},
"product_reference": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686"
},
"product_reference": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src"
},
"product_reference": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64"
},
"product_reference": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686"
},
"product_reference": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64"
},
"product_reference": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.70-22.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src"
},
"product_reference": "tomcat7-0:7.0.70-22.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.36-24.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src"
},
"product_reference": "tomcat8-0:8.0.36-24.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6",
"product_id": "6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch"
},
"product_reference": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src"
},
"product_reference": "log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src"
},
"product_reference": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64"
},
"product_reference": "tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64"
},
"product_reference": "tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.70-22.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src"
},
"product_reference": "tomcat7-0:7.0.70-22.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.36-24.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src"
},
"product_reference": "tomcat8-0:8.0.36-24.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.1"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"Shi Lei"
],
"organization": "Gear Team of Qihoo 360 Inc.",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6304",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2016-09-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1377600"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OCSP Status Request extension unbounded memory growth",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6304"
},
{
"category": "external",
"summary": "RHBZ#1377600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6304",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6304"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20160922.txt",
"url": "https://www.openssl.org/news/secadv/20160922.txt"
}
],
"release_date": "2016-09-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: OCSP Status Request extension unbounded memory growth"
},
{
"cve": "CVE-2016-7056",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2017-01-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1412120"
}
],
"notes": [
{
"category": "description",
"text": "A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: ECDSA P-256 timing attack key recovery",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7056"
},
{
"category": "external",
"summary": "RHBZ#1412120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7056",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7056"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"
}
],
"release_date": "2017-01-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: ECDSA P-256 timing attack key recovery"
},
{
"acknowledgments": [
{
"names": [
"Shi Lei"
],
"organization": "Gear Team of Qihoo 360 Inc."
}
],
"cve": "CVE-2016-8610",
"discovery_date": "2016-10-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1384743"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8610"
},
{
"category": "external",
"summary": "RHBZ#1384743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8610",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610"
},
{
"category": "external",
"summary": "http://security.360.cn/cve/CVE-2016-8610",
"url": "http://security.360.cn/cve/CVE-2016-8610"
}
],
"release_date": "2016-10-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS"
},
{
"cve": "CVE-2017-5645",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-04-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443635"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: Socket receiver deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw in Log4j-1.x is now identified by CVE-2019-17571. CVE-2017-5645 has been assigned by MITRE to a similar flaw identified in Log4j-2.x",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5645"
},
{
"category": "external",
"summary": "RHBZ#1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5645",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645"
}
],
"release_date": "2017-04-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: Socket receiver deserialization vulnerability"
},
{
"cve": "CVE-2017-5647",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2017-04-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1441205"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Tomcat\u0027s handling of pipelined requests when \"Sendfile\" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Incorrect handling of pipelined requests when send file was used",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5647"
},
{
"category": "external",
"summary": "RHBZ#1441205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5647",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5647"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5647",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5647"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
},
{
"category": "workaround",
"details": "The AJP connector does not support the sendfile capability. A server configured to only use the AJP connector (disable HTTP Connector) is not affected by this vulnerability.\n\nDisable the sendfile capability by setting useSendfile=\"false\" in the HTTP connector configuration. Note: Disabling sendfile, may impact performance on large files.",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Incorrect handling of pipelined requests when send file was used"
},
{
"cve": "CVE-2017-5648",
"discovery_date": "2017-04-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1441223"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Calls to application listeners did not use the appropriate facade object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5648"
},
{
"category": "external",
"summary": "RHBZ#1441223",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441223"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5648",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5648"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Calls to application listeners did not use the appropriate facade object"
},
{
"cve": "CVE-2017-5664",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2017-06-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1459158"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in the error page mechanism in Tomcat\u0027s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security constrained bypass in error page mechanism",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw can be triggered for static error pages only if the readonly property for the DefaultServlet is set to false in the $CATALINA_HOME/conf/web.xml file. The default for readonly is true.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5664"
},
{
"category": "external",
"summary": "RHBZ#1459158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459158"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5664",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5664"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5664",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5664"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44",
"url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15",
"url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15"
}
],
"release_date": "2017-06-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
},
{
"category": "workaround",
"details": "If it is necessary to have the DefaultServlet property readonly=false, use a jsp error page, for example Error404.jsp rather than a static html error page. Alternatively do not specify an error-page in the Deployment Descriptor and use a custom ErrorReportValve.",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Security constrained bypass in error page mechanism"
},
{
"cve": "CVE-2017-7674",
"discovery_date": "2017-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1480618"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Tomcat where the CORS Filter did not send a \"Vary: Origin\" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Vary header not added by CORS filter leading to cache poisoning",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7674"
},
{
"category": "external",
"summary": "RHBZ#1480618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1480618"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7674",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7674"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html",
"url": "https://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html",
"url": "https://tomcat.apache.org/security-8.html"
}
],
"release_date": "2017-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Vary header not added by CORS filter leading to cache poisoning"
},
{
"cve": "CVE-2019-17571",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2019-12-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1785616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: deserialization of untrusted data in SocketServer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "RHBZ#1785616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
}
],
"release_date": "2019-12-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T16:44:35+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1801"
},
{
"category": "workaround",
"details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
"product_ids": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch",
"6Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src",
"6Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686",
"6Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el6.src",
"6Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el6.src",
"6Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6.noarch",
"6Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el6.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch",
"7Server-JWS-3.1:log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-0:7.0.70-22.ep7.el7.src",
"7Server-JWS-3.1:tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-lib-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-log4j-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-selinux-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat7-webapps-0:7.0.70-22.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-0:8.0.36-24.ep7.el7.src",
"7Server-JWS-3.1:tomcat8-admin-webapps-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-docs-webapp-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-javadoc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-jsvc-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-lib-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-log4j-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-selinux-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7.noarch",
"7Server-JWS-3.1:tomcat8-webapps-0:8.0.36-24.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: deserialization of untrusted data in SocketServer"
}
]
}
RHSA-2017:1802
Vulnerability from csaf_redhat - Published: 2017-07-25 17:46 - Updated: 2026-05-14 22:23Summary
Red Hat Security Advisory: Red Hat JBoss Web Server Service Pack 1 security update
Severity
Important
Notes
Topic: An update is now available for Red Hat JBoss Web Server 3.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)
* A vulnerability was discovered in tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)
* A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)
* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.
5.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application.
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
54 references
Acknowledgments
the OpenSSL project
Gear Team of Qihoo 360 Inc.
Shi Lei
Gear Team of Qihoo 360 Inc.
Shi Lei
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server 3.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)\n\n* A vulnerability was discovered in tomcat\u0027s handling of pipelined requests when \"Sendfile\" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)\n\n* A vulnerability was discovered in the error page mechanism in Tomcat\u0027s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)\n\n* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1802",
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=3.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=3.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.1_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.1_Release_Notes/index.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/httpoxy",
"url": "https://access.redhat.com/security/vulnerabilities/httpoxy"
},
{
"category": "external",
"summary": "https://access.redhat.com/solutions/2435491",
"url": "https://access.redhat.com/solutions/2435491"
},
{
"category": "external",
"summary": "1441205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441205"
},
{
"category": "external",
"summary": "1441223",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441223"
},
{
"category": "external",
"summary": "1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "external",
"summary": "1459158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459158"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1802.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server Service Pack 1 security update",
"tracking": {
"current_release_date": "2026-05-14T22:23:34+00:00",
"generator": {
"date": "2026-05-14T22:23:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2017:1802",
"initial_release_date": "2017-07-25T17:46:13+00:00",
"revision_history": [
{
"date": "2017-07-25T17:46:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-07-25T17:46:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:23:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1",
"product": {
"name": "Red Hat JBoss Web Server 3.1",
"product_id": "Red Hat JBoss Web Server 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"Shi Lei"
],
"organization": "Gear Team of Qihoo 360 Inc.",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6304",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2016-09-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1377600"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OCSP Status Request extension unbounded memory growth",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6304"
},
{
"category": "external",
"summary": "RHBZ#1377600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6304",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6304"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20160922.txt",
"url": "https://www.openssl.org/news/secadv/20160922.txt"
}
],
"release_date": "2016-09-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: OCSP Status Request extension unbounded memory growth"
},
{
"cve": "CVE-2016-7056",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2017-01-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1412120"
}
],
"notes": [
{
"category": "description",
"text": "A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: ECDSA P-256 timing attack key recovery",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7056"
},
{
"category": "external",
"summary": "RHBZ#1412120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7056",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7056"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"
}
],
"release_date": "2017-01-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: ECDSA P-256 timing attack key recovery"
},
{
"acknowledgments": [
{
"names": [
"Shi Lei"
],
"organization": "Gear Team of Qihoo 360 Inc."
}
],
"cve": "CVE-2016-8610",
"discovery_date": "2016-10-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1384743"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8610"
},
{
"category": "external",
"summary": "RHBZ#1384743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8610",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8610"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610"
},
{
"category": "external",
"summary": "http://security.360.cn/cve/CVE-2016-8610",
"url": "http://security.360.cn/cve/CVE-2016-8610"
}
],
"release_date": "2016-10-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS"
},
{
"cve": "CVE-2017-5645",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-04-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443635"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: Socket receiver deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw in Log4j-1.x is now identified by CVE-2019-17571. CVE-2017-5645 has been assigned by MITRE to a similar flaw identified in Log4j-2.x",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5645"
},
{
"category": "external",
"summary": "RHBZ#1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5645",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645"
}
],
"release_date": "2017-04-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: Socket receiver deserialization vulnerability"
},
{
"cve": "CVE-2017-5647",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2017-04-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1441205"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Tomcat\u0027s handling of pipelined requests when \"Sendfile\" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Incorrect handling of pipelined requests when send file was used",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5647"
},
{
"category": "external",
"summary": "RHBZ#1441205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5647",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5647"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5647",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5647"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
},
{
"category": "workaround",
"details": "The AJP connector does not support the sendfile capability. A server configured to only use the AJP connector (disable HTTP Connector) is not affected by this vulnerability.\n\nDisable the sendfile capability by setting useSendfile=\"false\" in the HTTP connector configuration. Note: Disabling sendfile, may impact performance on large files.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Incorrect handling of pipelined requests when send file was used"
},
{
"cve": "CVE-2017-5648",
"discovery_date": "2017-04-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1441223"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Calls to application listeners did not use the appropriate facade object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5648"
},
{
"category": "external",
"summary": "RHBZ#1441223",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1441223"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5648",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5648"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Calls to application listeners did not use the appropriate facade object"
},
{
"cve": "CVE-2017-5664",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2017-06-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1459158"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in the error page mechanism in Tomcat\u0027s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security constrained bypass in error page mechanism",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw can be triggered for static error pages only if the readonly property for the DefaultServlet is set to false in the $CATALINA_HOME/conf/web.xml file. The default for readonly is true.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5664"
},
{
"category": "external",
"summary": "RHBZ#1459158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459158"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5664",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5664"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5664",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5664"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44",
"url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15",
"url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15"
}
],
"release_date": "2017-06-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
},
{
"category": "workaround",
"details": "If it is necessary to have the DefaultServlet property readonly=false, use a jsp error page, for example Error404.jsp rather than a static html error page. Alternatively do not specify an error-page in the Deployment Descriptor and use a custom ErrorReportValve.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Security constrained bypass in error page mechanism"
},
{
"cve": "CVE-2017-7674",
"discovery_date": "2017-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1480618"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Tomcat where the CORS Filter did not send a \"Vary: Origin\" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Vary header not added by CORS filter leading to cache poisoning",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7674"
},
{
"category": "external",
"summary": "RHBZ#1480618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1480618"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7674",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7674"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html",
"url": "https://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-8.html",
"url": "https://tomcat.apache.org/security-8.html"
}
],
"release_date": "2017-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Vary header not added by CORS filter leading to cache poisoning"
},
{
"cve": "CVE-2019-17571",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2019-12-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1785616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: deserialization of untrusted data in SocketServer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "RHBZ#1785616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
}
],
"release_date": "2019-12-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-07-25T17:46:13+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1802"
},
{
"category": "workaround",
"details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: deserialization of untrusted data in SocketServer"
}
]
}
RHSA-2017:2423
Vulnerability from csaf_redhat - Published: 2017-08-07 08:41 - Updated: 2026-05-14 22:23Summary
Red Hat Security Advisory: log4j security update
Severity
Important
Notes
Topic: An update for log4j is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Log4j is a tool to help the programmer output log statements to a variety of output targets.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
8.1 (High)
Affected products
Fixed
32 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.
9.8 (Critical)
Affected products
Fixed
32 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for log4j is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Log4j is a tool to help the programmer output log statements to a variety of output targets.\n\nSecurity Fix(es):\n\n* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:2423",
"url": "https://access.redhat.com/errata/RHSA-2017:2423"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2423.json"
}
],
"title": "Red Hat Security Advisory: log4j security update",
"tracking": {
"current_release_date": "2026-05-14T22:23:39+00:00",
"generator": {
"date": "2026-05-14T22:23:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2017:2423",
"initial_release_date": "2017-08-07T08:41:14+00:00",
"revision_history": [
{
"date": "2017-08-07T08:41:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-08-07T08:41:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:23:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-0:1.2.17-16.el7_4.src",
"product": {
"name": "log4j-0:1.2.17-16.el7_4.src",
"product_id": "log4j-0:1.2.17-16.el7_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j@1.2.17-16.el7_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "log4j-0:1.2.17-16.el7_4.noarch",
"product": {
"name": "log4j-0:1.2.17-16.el7_4.noarch",
"product_id": "log4j-0:1.2.17-16.el7_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j@1.2.17-16.el7_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"product": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"product_id": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-javadoc@1.2.17-16.el7_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"product": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"product_id": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/log4j-manual@1.2.17-16.el7_4?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src"
},
"product_reference": "log4j-0:1.2.17-16.el7_4.src",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
},
"product_reference": "log4j-manual-0:1.2.17-16.el7_4.noarch",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-5645",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-04-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443635"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: Socket receiver deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw in Log4j-1.x is now identified by CVE-2019-17571. CVE-2017-5645 has been assigned by MITRE to a similar flaw identified in Log4j-2.x",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5645"
},
{
"category": "external",
"summary": "RHBZ#1443635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5645",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645"
}
],
"release_date": "2017-04-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-07T08:41:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: Socket receiver deserialization vulnerability"
},
{
"cve": "CVE-2019-17571",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2019-12-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1785616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "log4j: deserialization of untrusted data in SocketServer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17571"
},
{
"category": "external",
"summary": "RHBZ#1785616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
}
],
"release_date": "2019-12-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-07T08:41:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2423"
},
{
"category": "workaround",
"details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
"product_ids": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Client-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Client-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7ComputeNode-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7ComputeNode-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Server-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Server-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-0:1.2.17-16.el7_4.src",
"7Workstation-optional-7.4.Z:log4j-javadoc-0:1.2.17-16.el7_4.noarch",
"7Workstation-optional-7.4.Z:log4j-manual-0:1.2.17-16.el7_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "log4j: deserialization of untrusted data in SocketServer"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…