{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Data Virtualization.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.\n\nThis Service Pack release of Red Hat JBoss Data Virtualization 6.4.8.SP1 (Service Pack 1) serves as a replacement for Red Hat JBoss Data Virtualization 6.4.8, and mitigates the impact of the log4j CVE\u0027s referenced in this document by removing the affected classes from the patch.\n\nNote: customers should update their EAP 6.4 installation with the corresponding security fixes that have been released for that (see RHSA-2022:0437 and https://access.redhat.com/site/solutions/625683)\n\nSecurity Fix(es):\n\n* log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571)\n\n* log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)\n\n* log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)\n\n* log4j: improper validation of certificate with host mismatch in SMTP appender (CVE-2020-9488)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0497",
        "url": "https://access.redhat.com/errata/RHSA-2022:0497"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.4",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/"
      },
      {
        "category": "external",
        "summary": "1785616",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
      },
      {
        "category": "external",
        "summary": "1831139",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831139"
      },
      {
        "category": "external",
        "summary": "2031667",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
      },
      {
        "category": "external",
        "summary": "2041949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
      },
      {
        "category": "external",
        "summary": "2041959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
      },
      {
        "category": "external",
        "summary": "2041967",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0497.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4.8.SP1 security update",
    "tracking": {
      "current_release_date": "2026-05-22T15:06:07+00:00",
      "generator": {
        "date": "2026-05-22T15:06:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0497",
      "initial_release_date": "2022-02-09T13:11:07+00:00",
      "revision_history": [
        {
          "date": "2022-02-09T13:11:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-09T13:11:07+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-22T15:06:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Data Virtualization 6.4.8.SP1",
                "product": {
                  "name": "Red Hat JBoss Data Virtualization 6.4.8.SP1",
                  "product_id": "Red Hat JBoss Data Virtualization 6.4.8.SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_virtualization:6.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Virtualization"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1785616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: deserialization of untrusted data in SocketServer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "RHBZ#1785616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
        }
      ],
      "release_date": "2019-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: deserialization of untrusted data in SocketServer"
    },
    {
      "cve": "CVE-2020-9488",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2020-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1831139"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: improper validation of certificate with host mismatch in SMTP appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-9488"
        },
        {
          "category": "external",
          "summary": "RHBZ#1831139",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831139"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9488",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-9488"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9488",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9488"
        }
      ],
      "release_date": "2020-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "log4j: improper validation of certificate with host mismatch in SMTP appender"
    },
    {
      "cve": "CVE-2021-4104",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2031667"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker\u0027s JNDI LDAP endpoint.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Based on the conditions to be exploitable (see details below), the risk is much lower than Log4j 2.x and Red Hat has assessed this to be Moderate severity. This flaw has been filed for Log4j 1.x, and the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228\n\nNote this flaw ONLY affects applications which are specifically configured to use JMSAppender, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSAppender to the attacker\u0027s JNDI LDAP endpoint. \n\nIf the Log4j configuration is set TopicBindingName or TopicConnectionFactoryBindingName configurations allowing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228 Log4j 2.x, Log4j 1.x is vulnerable. However, the attack vector is reduced as it depends on having write access, which is not a standard configuration rather than untrusted user input. These are sufficient factors beyond the attacker\u0027s control.\n\nThe tomcat package shipped with Red Hat Enterprise Linux does not include log4j but it does include a default configuration for log4j, log4j.properties, which could be used with tomcat if users choose to install and configure the library. The JMSAppender is not enabled by default, and the permissions of the file can only be modified as root.\n\nRed Hat Virtualization ships log4j12-1.2.17, but it is used and configured in a way which makes this flaw not possible to exploit. Therefore impact is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "RHBZ#2031667",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
        },
        {
          "category": "external",
          "summary": "RHSB-2021-009",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4104",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4104",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301",
          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx",
          "url": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/13/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/13/1"
        }
      ],
      "release_date": "2021-12-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSAppender in the Log4j configuration if it is used\n- Remove the JMSAppender class from the classpath. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender"
    },
    {
      "cve": "CVE-2022-23302",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this flaw ONLY affects applications which are specifically configured to use JMSSink, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSSink to the attacker\u0027s JNDI LDAP endpoint.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JMSSink is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23302",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/3",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/3"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSSink in the Log4j configuration if it is used\n- Remove the JMSSink class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSSink.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink"
    },
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JDBCAppender is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23305",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/4",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/4"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JDBCAppender in the Log4j configuration if it is used\n- Remove the JDBCAppender class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/jdbc/JDBCAppender.class\n```",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender"
    },
    {
      "cve": "CVE-2022-23307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041967"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Unsafe deserialization flaw in Chainsaw log viewer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Chainsaw is a standalone graphical user interface for viewing log entries in log4j. This flaw may be bypassed by using other available means to access log entries.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization ships a vulnerable version of the log4j package, however chainsaw is not part of typical use cases. An attacker looking to exploit this would need to not only be able to generate a malicious log entry, but also have the necessary access and permissions to start chainsaw on the engine node. Therefore the impact of this vulnerability for Red Hat Virtualization is rated Low.\n\nSimilar to Red Hat Virtualization in OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of log4j package, however vulnerable chainsaw component is not used by default. Therefore the impact to OCP is reduced to Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041967",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/5",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/5"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-09T13:11:07+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0497"
        },
        {
          "category": "workaround",
          "details": "These are the mitigations available for this flaw for log4j 1.x:\n- Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself.\n- Remove the Chainsaw classes from the log4j jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/chainsaw/*\n```\n(log4j jars may be nested in zip archives within product)",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Data Virtualization.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.\n\nThis Service Pack release of Red Hat JBoss Data Virtualization 6.4.8.SP2 (Service Pack 2) serves as a replacement for Red Hat JBoss Data Virtualization 6.4.8 and Red Hat JBoss Data Virtualization 6.4.8.SP1, and mitigates the impact of the log4j CVE\u0027s referenced in this document by removing the affected classes from the patch.\n\nNote: customers should update their EAP 6.4 installation with the corresponding security fixes that have been released for that (see RHSA-2022:0437 and https://access.redhat.com/site/solutions/625683)\n\nSecurity Fix(es):\n\n* log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571)\n\n* log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)\n\n* log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)\n\n* log4j: improper validation of certificate with host mismatch in SMTP appender (CVE-2020-9488)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0507",
        "url": "https://access.redhat.com/errata/RHSA-2022:0507"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.4",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/"
      },
      {
        "category": "external",
        "summary": "1785616",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
      },
      {
        "category": "external",
        "summary": "1831139",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831139"
      },
      {
        "category": "external",
        "summary": "2031667",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
      },
      {
        "category": "external",
        "summary": "2041949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
      },
      {
        "category": "external",
        "summary": "2041959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
      },
      {
        "category": "external",
        "summary": "2041967",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0507.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4.8.SP2 security update",
    "tracking": {
      "current_release_date": "2026-05-22T15:06:07+00:00",
      "generator": {
        "date": "2026-05-22T15:06:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0507",
      "initial_release_date": "2022-02-10T17:26:37+00:00",
      "revision_history": [
        {
          "date": "2022-02-10T17:26:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-10T17:26:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-22T15:06:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Data Virtualization 6.4.8.SP2",
                "product": {
                  "name": "Red Hat JBoss Data Virtualization 6.4.8.SP2",
                  "product_id": "Red Hat JBoss Data Virtualization 6.4.8.SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_virtualization:6.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Virtualization"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1785616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: deserialization of untrusted data in SocketServer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "RHBZ#1785616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
        }
      ],
      "release_date": "2019-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: deserialization of untrusted data in SocketServer"
    },
    {
      "cve": "CVE-2020-9488",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2020-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1831139"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: improper validation of certificate with host mismatch in SMTP appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-9488"
        },
        {
          "category": "external",
          "summary": "RHBZ#1831139",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831139"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9488",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-9488"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9488",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9488"
        }
      ],
      "release_date": "2020-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "log4j: improper validation of certificate with host mismatch in SMTP appender"
    },
    {
      "cve": "CVE-2021-4104",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2031667"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker\u0027s JNDI LDAP endpoint.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Based on the conditions to be exploitable (see details below), the risk is much lower than Log4j 2.x and Red Hat has assessed this to be Moderate severity. This flaw has been filed for Log4j 1.x, and the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228\n\nNote this flaw ONLY affects applications which are specifically configured to use JMSAppender, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSAppender to the attacker\u0027s JNDI LDAP endpoint. \n\nIf the Log4j configuration is set TopicBindingName or TopicConnectionFactoryBindingName configurations allowing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228 Log4j 2.x, Log4j 1.x is vulnerable. However, the attack vector is reduced as it depends on having write access, which is not a standard configuration rather than untrusted user input. These are sufficient factors beyond the attacker\u0027s control.\n\nThe tomcat package shipped with Red Hat Enterprise Linux does not include log4j but it does include a default configuration for log4j, log4j.properties, which could be used with tomcat if users choose to install and configure the library. The JMSAppender is not enabled by default, and the permissions of the file can only be modified as root.\n\nRed Hat Virtualization ships log4j12-1.2.17, but it is used and configured in a way which makes this flaw not possible to exploit. Therefore impact is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "RHBZ#2031667",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
        },
        {
          "category": "external",
          "summary": "RHSB-2021-009",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4104",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4104",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4104"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301",
          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx",
          "url": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/13/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/13/1"
        }
      ],
      "release_date": "2021-12-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSAppender in the Log4j configuration if it is used\n- Remove the JMSAppender class from the classpath. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender"
    },
    {
      "cve": "CVE-2022-23302",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this flaw ONLY affects applications which are specifically configured to use JMSSink, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSSink to the attacker\u0027s JNDI LDAP endpoint.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JMSSink is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23302",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/3",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/3"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSSink in the Log4j configuration if it is used\n- Remove the JMSSink class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSSink.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink"
    },
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JDBCAppender is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23305",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/4",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/4"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JDBCAppender in the Log4j configuration if it is used\n- Remove the JDBCAppender class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/jdbc/JDBCAppender.class\n```",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender"
    },
    {
      "cve": "CVE-2022-23307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041967"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Unsafe deserialization flaw in Chainsaw log viewer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Chainsaw is a standalone graphical user interface for viewing log entries in log4j. This flaw may be bypassed by using other available means to access log entries.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization ships a vulnerable version of the log4j package, however chainsaw is not part of typical use cases. An attacker looking to exploit this would need to not only be able to generate a malicious log entry, but also have the necessary access and permissions to start chainsaw on the engine node. Therefore the impact of this vulnerability for Red Hat Virtualization is rated Low.\n\nSimilar to Red Hat Virtualization in OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of log4j package, however vulnerable chainsaw component is not used by default. Therefore the impact to OCP is reduced to Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Data Virtualization 6.4.8.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041967",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/5",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/5"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-10T17:26:37+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0507"
        },
        {
          "category": "workaround",
          "details": "These are the mitigations available for this flaw for log4j 1.x:\n- Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself.\n- Remove the Chainsaw classes from the log4j jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/chainsaw/*\n```\n(log4j jars may be nested in zip archives within product)",
          "product_ids": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Data Virtualization 6.4.8.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for log4j is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Log4j is a tool to help the programmer output log statements to a variety of output targets.\n\nSecurity Fix(es):\n\n* log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:5053",
        "url": "https://access.redhat.com/errata/RHSA-2022:5053"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1785616",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5053.json"
      }
    ],
    "title": "Red Hat Security Advisory: log4j security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:32:30+00:00",
      "generator": {
        "date": "2026-05-14T22:32:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2022:5053",
      "initial_release_date": "2022-06-15T10:48:31+00:00",
      "revision_history": [
        {
          "date": "2022-06-15T10:48:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-06-15T10:48:31+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:32:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6 ELS)",
                  "product_id": "6Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
                  "product_id": "6Server-optional-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-0:1.2.14-6.7.el6_10.src",
                "product": {
                  "name": "log4j-0:1.2.14-6.7.el6_10.src",
                  "product_id": "log4j-0:1.2.14-6.7.el6_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j@1.2.14-6.7.el6_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-0:1.2.14-6.7.el6_10.x86_64",
                "product": {
                  "name": "log4j-0:1.2.14-6.7.el6_10.x86_64",
                  "product_id": "log4j-0:1.2.14-6.7.el6_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j@1.2.14-6.7.el6_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
                "product": {
                  "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
                  "product_id": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-debuginfo@1.2.14-6.7.el6_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
                "product": {
                  "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
                  "product_id": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-javadoc@1.2.14-6.7.el6_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
                "product": {
                  "name": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
                  "product_id": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-manual@1.2.14-6.7.el6_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-0:1.2.14-6.7.el6_10.i686",
                "product": {
                  "name": "log4j-0:1.2.14-6.7.el6_10.i686",
                  "product_id": "log4j-0:1.2.14-6.7.el6_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j@1.2.14-6.7.el6_10?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
                "product": {
                  "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
                  "product_id": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-debuginfo@1.2.14-6.7.el6_10?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
                "product": {
                  "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
                  "product_id": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-javadoc@1.2.14-6.7.el6_10?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-manual-0:1.2.14-6.7.el6_10.i686",
                "product": {
                  "name": "log4j-manual-0:1.2.14-6.7.el6_10.i686",
                  "product_id": "log4j-manual-0:1.2.14-6.7.el6_10.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-manual@1.2.14-6.7.el6_10?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-0:1.2.14-6.7.el6_10.s390x",
                "product": {
                  "name": "log4j-0:1.2.14-6.7.el6_10.s390x",
                  "product_id": "log4j-0:1.2.14-6.7.el6_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j@1.2.14-6.7.el6_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
                "product": {
                  "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
                  "product_id": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-debuginfo@1.2.14-6.7.el6_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
                "product": {
                  "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
                  "product_id": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-javadoc@1.2.14-6.7.el6_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "log4j-manual-0:1.2.14-6.7.el6_10.s390x",
                "product": {
                  "name": "log4j-manual-0:1.2.14-6.7.el6_10.s390x",
                  "product_id": "log4j-manual-0:1.2.14-6.7.el6_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/log4j-manual@1.2.14-6.7.el6_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.src"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.src",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
          "product_id": "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.src"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.src",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.i686",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.s390x",
        "relates_to_product_reference": "6Server-optional-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
          "product_id": "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
        },
        "product_reference": "log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
        "relates_to_product_reference": "6Server-optional-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1785616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: deserialization of untrusted data in SocketServer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
          "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
          "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.src",
          "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
          "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
          "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
          "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
          "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
          "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
          "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
          "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
          "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.src",
          "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
          "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
          "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
          "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
          "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
          "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
          "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
          "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "RHBZ#1785616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
        }
      ],
      "release_date": "2019-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-06-15T10:48:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:5053"
        },
        {
          "category": "workaround",
          "details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
          "product_ids": [
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.src",
            "6Server-optional-ELS:log4j-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.i686",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.s390x",
            "6Server-optional-ELS:log4j-manual-0:1.2.14-6.7.el6_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: deserialization of untrusted data in SocketServer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for log4j",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for log4j fixes the following issues:\n\n- CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2020-53,SUSE-SLE-Module-Basesystem-15-2020-53,SUSE-SLE-Module-Basesystem-15-SP1-2020-53,SUSE-SLE-Module-Development-Tools-15-2020-53,SUSE-SLE-Module-Development-Tools-15-SP1-2020-53,SUSE-SLE-Module-Development-Tools-OBS-15-2020-53,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-53",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0053-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:0053-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200053-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:0053-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200053-1.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159646",
        "url": "https://bugzilla.suse.com/1159646"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17571 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17571/"
      }
    ],
    "title": "Security update for log4j",
    "tracking": {
      "current_release_date": "2020-01-09T10:16:33Z",
      "generator": {
        "date": "2020-01-09T10:16:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:0053-1",
      "initial_release_date": "2020-01-09T10:16:33Z",
      "revision_history": [
        {
          "date": "2020-01-09T10:16:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-1.2.17-5.3.1.noarch",
                "product": {
                  "name": "log4j-1.2.17-5.3.1.noarch",
                  "product_id": "log4j-1.2.17-5.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-javadoc-1.2.17-5.3.1.noarch",
                "product": {
                  "name": "log4j-javadoc-1.2.17-5.3.1.noarch",
                  "product_id": "log4j-javadoc-1.2.17-5.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-manual-1.2.17-5.3.1.noarch",
                "product": {
                  "name": "log4j-manual-1.2.17-5.3.1.noarch",
                  "product_id": "log4j-manual-1.2.17-5.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-mini-1.2.17-5.3.1.noarch",
                "product": {
                  "name": "log4j-mini-1.2.17-5.3.1.noarch",
                  "product_id": "log4j-mini-1.2.17-5.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP1",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP1",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.17-5.3.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15:log4j-1.2.17-5.3.1.noarch"
        },
        "product_reference": "log4j-1.2.17-5.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.17-5.3.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP1:log4j-1.2.17-5.3.1.noarch"
        },
        "product_reference": "log4j-1.2.17-5.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-1.2.17-5.3.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15:log4j-manual-1.2.17-5.3.1.noarch"
        },
        "product_reference": "log4j-manual-1.2.17-5.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-1.2.17-5.3.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP1:log4j-manual-1.2.17-5.3.1.noarch"
        },
        "product_reference": "log4j-manual-1.2.17-5.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP1:log4j-1.2.17-5.3.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15:log4j-1.2.17-5.3.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP1:log4j-manual-1.2.17-5.3.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15:log4j-manual-1.2.17-5.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17571",
          "url": "https://www.suse.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159646 for CVE-2019-17571",
          "url": "https://bugzilla.suse.com/1159646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP1:log4j-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15:log4j-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP1:log4j-manual-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15:log4j-manual-1.2.17-5.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP1:log4j-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15:log4j-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP1:log4j-manual-1.2.17-5.3.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15:log4j-manual-1.2.17-5.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-09T10:16:33Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2019-17571"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for log4j",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for log4j fixes the following issues:\n\n- CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "HPE-Helion-OpenStack-8-2020-54,SUSE-2020-54,SUSE-OpenStack-Cloud-7-2020-54,SUSE-OpenStack-Cloud-8-2020-54,SUSE-OpenStack-Cloud-Crowbar-8-2020-54,SUSE-SLE-SAP-12-SP1-2020-54,SUSE-SLE-SAP-12-SP2-2020-54,SUSE-SLE-SAP-12-SP3-2020-54,SUSE-SLE-SDK-12-SP4-2020-54,SUSE-SLE-SDK-12-SP5-2020-54,SUSE-SLE-SERVER-12-SP1-2020-54,SUSE-SLE-SERVER-12-SP2-2020-54,SUSE-SLE-SERVER-12-SP2-BCL-2020-54,SUSE-SLE-SERVER-12-SP3-2020-54,SUSE-SLE-SERVER-12-SP3-BCL-2020-54,SUSE-SLE-SERVER-12-SP4-2020-54,SUSE-SLE-SERVER-12-SP5-2020-54,SUSE-Storage-5-2020-54",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0054-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:0054-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200054-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:0054-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200054-1.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159646",
        "url": "https://bugzilla.suse.com/1159646"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17571 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17571/"
      }
    ],
    "title": "Security update for log4j",
    "tracking": {
      "current_release_date": "2020-01-09T10:17:47Z",
      "generator": {
        "date": "2020-01-09T10:17:47Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:0054-1",
      "initial_release_date": "2020-01-09T10:17:47Z",
      "revision_history": [
        {
          "date": "2020-01-09T10:17:47Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-1.2.15-126.3.1.noarch",
                "product": {
                  "name": "log4j-1.2.15-126.3.1.noarch",
                  "product_id": "log4j-1.2.15-126.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-javadoc-1.2.15-126.3.1.noarch",
                "product": {
                  "name": "log4j-javadoc-1.2.15-126.3.1.noarch",
                  "product_id": "log4j-javadoc-1.2.15-126.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-manual-1.2.15-126.3.1.noarch",
                "product": {
                  "name": "log4j-manual-1.2.15-126.3.1.noarch",
                  "product_id": "log4j-manual-1.2.15-126.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "log4j-mini-1.2.15-126.3.1.noarch",
                "product": {
                  "name": "log4j-mini-1.2.15-126.3.1.noarch",
                  "product_id": "log4j-mini-1.2.15-126.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "HPE Helion OpenStack 8",
                "product": {
                  "name": "HPE Helion OpenStack 8",
                  "product_id": "HPE Helion OpenStack 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:hpe-helion-openstack:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 7",
                "product": {
                  "name": "SUSE OpenStack Cloud 7",
                  "product_id": "SUSE OpenStack Cloud 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 8",
                "product": {
                  "name": "SUSE OpenStack Cloud 8",
                  "product_id": "SUSE OpenStack Cloud 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud Crowbar 8",
                "product": {
                  "name": "SUSE OpenStack Cloud Crowbar 8",
                  "product_id": "SUSE OpenStack Cloud Crowbar 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 5",
                "product": {
                  "name": "SUSE Enterprise Storage 5",
                  "product_id": "SUSE Enterprise Storage 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of HPE Helion OpenStack 8",
          "product_id": "HPE Helion OpenStack 8:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "HPE Helion OpenStack 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE OpenStack Cloud 7",
          "product_id": "SUSE OpenStack Cloud 7:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE OpenStack Cloud 8",
          "product_id": "SUSE OpenStack Cloud 8:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE OpenStack Cloud Crowbar 8",
          "product_id": "SUSE OpenStack Cloud Crowbar 8:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-manual-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-manual-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-manual-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-manual-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-manual-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP3-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-126.3.1.noarch as component of SUSE Enterprise Storage 5",
          "product_id": "SUSE Enterprise Storage 5:log4j-1.2.15-126.3.1.noarch"
        },
        "product_reference": "log4j-1.2.15-126.3.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "HPE Helion OpenStack 8:log4j-1.2.15-126.3.1.noarch",
          "SUSE Enterprise Storage 5:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP2-BCL:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3-BCL:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3-LTSS:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP4:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-manual-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-1.2.15-126.3.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-manual-1.2.15-126.3.1.noarch",
          "SUSE OpenStack Cloud 7:log4j-1.2.15-126.3.1.noarch",
          "SUSE OpenStack Cloud 8:log4j-1.2.15-126.3.1.noarch",
          "SUSE OpenStack Cloud Crowbar 8:log4j-1.2.15-126.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17571",
          "url": "https://www.suse.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159646 for CVE-2019-17571",
          "url": "https://bugzilla.suse.com/1159646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "HPE Helion OpenStack 8:log4j-1.2.15-126.3.1.noarch",
            "SUSE Enterprise Storage 5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP2-BCL:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3-BCL:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-manual-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-manual-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud 7:log4j-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud 8:log4j-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud Crowbar 8:log4j-1.2.15-126.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "HPE Helion OpenStack 8:log4j-1.2.15-126.3.1.noarch",
            "SUSE Enterprise Storage 5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP2-BCL:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3-BCL:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:log4j-manual-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-1.2.15-126.3.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:log4j-manual-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud 7:log4j-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud 8:log4j-1.2.15-126.3.1.noarch",
            "SUSE OpenStack Cloud Crowbar 8:log4j-1.2.15-126.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-09T10:17:47Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2019-17571"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for log4j",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for log4j fixes the following issues:\n\n- CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "sleposp3-log4j-14267,slessp4-log4j-14267",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_14267-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:14267-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-202014267-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:14267-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-January/006321.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159646",
        "url": "https://bugzilla.suse.com/1159646"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17571 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17571/"
      }
    ],
    "title": "Security update for log4j",
    "tracking": {
      "current_release_date": "2020-01-09T15:11:02Z",
      "generator": {
        "date": "2020-01-09T15:11:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:14267-1",
      "initial_release_date": "2020-01-09T15:11:02Z",
      "revision_history": [
        {
          "date": "2020-01-09T15:11:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "log4j-1.2.15-26.32.14.1.noarch",
                "product": {
                  "name": "log4j-1.2.15-26.32.14.1.noarch",
                  "product_id": "log4j-1.2.15-26.32.14.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Point of Sale 11 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Point of Sale 11 SP3",
                  "product_id": "SUSE Linux Enterprise Point of Sale 11 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-pos:11:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse_sles:11:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-26.32.14.1.noarch as component of SUSE Linux Enterprise Point of Sale 11 SP3",
          "product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:log4j-1.2.15-26.32.14.1.noarch"
        },
        "product_reference": "log4j-1.2.15-26.32.14.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "log4j-1.2.15-26.32.14.1.noarch as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:log4j-1.2.15-26.32.14.1.noarch"
        },
        "product_reference": "log4j-1.2.15-26.32.14.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Point of Sale 11 SP3:log4j-1.2.15-26.32.14.1.noarch",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:log4j-1.2.15-26.32.14.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17571",
          "url": "https://www.suse.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159646 for CVE-2019-17571",
          "url": "https://bugzilla.suse.com/1159646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Point of Sale 11 SP3:log4j-1.2.15-26.32.14.1.noarch",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:log4j-1.2.15-26.32.14.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Point of Sale 11 SP3:log4j-1.2.15-26.32.14.1.noarch",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:log4j-1.2.15-26.32.14.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-09T15:11:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2019-17571"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201912-0889",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "financial services lending and leasing",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.8.0"
      },
      {
        "model": "log4j",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "1.2.17"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.7"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "financial services lending and leasing",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0"
      },
      {
        "model": "communications network integrity",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.2"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.0"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.2.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.29"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1.0.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "retail extract transform and load",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2"
      },
      {
        "model": "communications network integrity",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.6"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "oncommand system manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "3.0"
      },
      {
        "model": "financial services lending and leasing",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "bookkeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "4.14.3"
      },
      {
        "model": "oncommand system manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "3.1.3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2.11"
      },
      {
        "model": "oncommand workflow automation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.3.6.0.0"
      },
      {
        "model": "log4j",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apache",
        "version": "1.2 to  1.2.17"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:apache:log4j",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      }
    ],
    "trust": 0.8
  },
  "cve": "CVE-2019-17571",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2019-17571",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-149831",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2019-17571",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-17571",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-17571",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-17571",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201912-950",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-149831",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-17571",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. Log4j Contains a vulnerability in the deserialization of unreliable data.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. (CVE-2019-17571)\nA flaw was found in the Java logging library Apache Log4j in version 1.x. This allows a remote malicious user to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker\u0027s JNDI LDAP endpoint. (CVE-2021-4104). Description:\n\nRed Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems - such as multiple databases, XML\nfiles, and even Hadoop systems - appear as a set of tables in a local\ndatabase. \n\nThis Service Pack release of Red Hat JBoss Data Virtualization 6.4.8.SP1\n(Service Pack 1) serves as a replacement for Red Hat JBoss Data\nVirtualization 6.4.8, and mitigates the impact of the log4j CVE\u0027s\nreferenced in this document by removing the affected classes from the\npatch. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Bugs fixed (https://bugzilla.redhat.com/):\n\n1785616 - CVE-2019-17571 log4j: deserialization of untrusted data in SocketServer\n1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender\n2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender\n2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink\n2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender\n2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer\n\n5. \n\nFor the oldstable distribution (stretch), this problem has been fixed\nin version 1.2.17-7+deb9u1. \n\nFor the stable distribution (buster), this problem has been fixed in\nversion 1.2.17-8+deb10u1. \n\nWe recommend that you upgrade your apache-log4j1.2 packages. \n\nFor the detailed security status of apache-log4j1.2 please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/apache-log4j1.2\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl6/FH1fFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0RAJQ/9HLo721J7x4kWxFiWIP0Ui1xl8ZM6MBhA8qYfUD4DxKoHHfvYEq6Q7TTD\n+FlTX5rRrjvgHF+MgxG1XDHtwv7XWhczEiHzZKHLCX3CsG+AL+CMmGoVqBtKEncC\nFGYbVCSKYzxM8LaX2G1EyCzT2zfGZvPT5nFT7zAV0Ge6vpvWklF0s168h4pbG9hE\ncF6aPqAlWMy5pLVRI+3XE1og4MECjqXB9a7HSWlHfur6NSnQlrHhWOCDJBw5zpPu\nAKEfW5GvBaCdxdat1xTFqCu6h5387dtNsBlRrefp9q+fcrGj2Z351Lv7ccG5Co8T\ne/7iNyABu2fmi8x4WFQwS3PY4AsM/2sa+KHfXnttSXcQniXAccg6S1eCaWVqdNfZ\n3LPmeBC5gX3UqDNZTVv+kvHvv7EsD1/6bMeVZlKQZkYAeysbLWdjkA+88f6kaVwD\nqv6mWCGo5k7ZoWCUKD1Zjz8VwBT4EI/2II5D93QgblVkHDX9CESfipIjJBJp7aJ7\nwS2kvdXOko3JDaJbScpGmCnjCb5NhJ1KiBZSzXYHv3uhoqlI5QvYvC1bFHqC2GnT\ncF4syuMELN6nZ/Yoz8sJiT4Ilppz98vLerHbJoJZIPEOh15k8UKaFkdt5CpI8MGK\n4+sL2iWyTtCjGYGuhDkk0KyLcqijybv282VIkXDtAetpi8MTdsE=\n=eH9L\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: log4j security update\nAdvisory ID:       RHSA-2022:5053-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2022:5053\nIssue date:        2022-06-15\nCVE Names:         CVE-2019-17571 \n=====================================================================\n\n1. Summary:\n\nAn update for log4j is now available for Red Hat Enterprise Linux 6\nExtended Lifecycle Support. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Server (v. 6 ELS) - i386, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6 ELS) - i386, s390x, x86_64\n\n3. Description:\n\nLog4j is a tool to help the programmer output log statements to a variety\nof output targets. \n\nSecurity Fix(es):\n\n* log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Server (v. 6 ELS):\n\nSource:\nlog4j-1.2.14-6.7.el6_10.src.rpm\n\ni386:\nlog4j-1.2.14-6.7.el6_10.i686.rpm\nlog4j-debuginfo-1.2.14-6.7.el6_10.i686.rpm\n\ns390x:\nlog4j-1.2.14-6.7.el6_10.s390x.rpm\nlog4j-debuginfo-1.2.14-6.7.el6_10.s390x.rpm\n\nx86_64:\nlog4j-1.2.14-6.7.el6_10.x86_64.rpm\nlog4j-debuginfo-1.2.14-6.7.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6 ELS):\n\ni386:\nlog4j-debuginfo-1.2.14-6.7.el6_10.i686.rpm\nlog4j-javadoc-1.2.14-6.7.el6_10.i686.rpm\nlog4j-manual-1.2.14-6.7.el6_10.i686.rpm\n\ns390x:\nlog4j-debuginfo-1.2.14-6.7.el6_10.s390x.rpm\nlog4j-javadoc-1.2.14-6.7.el6_10.s390x.rpm\nlog4j-manual-1.2.14-6.7.el6_10.s390x.rpm\n\nx86_64:\nlog4j-debuginfo-1.2.14-6.7.el6_10.x86_64.rpm\nlog4j-javadoc-1.2.14-6.7.el6_10.x86_64.rpm\nlog4j-manual-1.2.14-6.7.el6_10.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-17571\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2022 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYqnJeNzjgjWX9erEAQgGiQ/8DiTAwAZPNPQlrV5ItJ3I3AxT4ruBA995\nbPYquIN3zX0afhrGRMWTs/aD/4vYkbUtLA5QzqYlE1dsbleGHcAbxmSfY+wE8tE7\nBg02UGNI7bru25JPZE5lSuNA8McZw/aBRcorwhSVRiBQ1GbPMQqAimbrNx98r6Qe\nQLupPSuNmbczUOh9X4gbPoqEeIizf8MtYbMS+LbpeIZWH7rELk3t7o63MerkAIYi\nyWjXzL8Xn3ylflXUzdRNIJ8QZC+nU7kgib3Ugm4TbC9F5A0w7TiAomb9qnHOP+mW\n2HoGje7VZIeGX7rwtCIttW5Z9/LztkhXb/Yk1tzMM3Jo/HWgqoP8dULxian7L8aE\nDFlrGSbF0OQTDiYGVgGX2uW89Yi/XbX1nP7q0MtBq0D5P7z7yLKfHNyeksX+TFyV\nkxhUrHY8u3JLvWxWBoRzEH8TOhuoMXRIp/FkDpnnM6dDbwSyQsalGZzWnTqOHSwi\nsZDFnmuLQDUZQtslb4suSRgdQbu0xnvc+i38jbhoEOcH4xJGZnizRY/97wytq3Jp\nnBj2G0sRSMNlbcA4rr0zzTT6K/HiBhI9OWn3n76lj7jySFYrIUmPgCNhZy5dV1vx\nnK0c1WI+oRXn4xT4ekCYQUM/uysgWfeVLr9b2ArwaxMxvc4GiLA713gUgelejl6h\n9kT6WndTNP0=\n=VXI/\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. =========================================================================\nUbuntu Security Notice USN-5998-1\nApril 05, 2023\n\napache-log4j1.2 vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Apache Log4j. \n\nSoftware Description:\n- apache-log4j1.2: Java-based open-source logging tool\n\nDetails:\n\nIt was discovered that the SocketServer component of Apache Log4j 1.2\nincorrectly handled deserialization. An attacker could possibly use this issue\nto execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. \n(CVE-2019-17571)\n\nIt was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly\nhandled deserialization. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2022-23302)\n\nIt was discovered that Apache Log4j 1.2 incorrectly handled certain SQL\nstatements. A remote attacker could possibly use this issue to perform an SQL\ninjection attack and alter the database. This issue was only fixed in Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)\n\nIt was discovered that the Chainsaw component of Apache Log4j 1.2 incorrectly\nhandled deserialization. An attacker could possibly use this issue to execute\narbitrary code. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04\nLTS. (CVE-2022-23307)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n  liblog4j1.2-java                1.2.17-9ubuntu0.2\n\nUbuntu 18.04 LTS:\n  liblog4j1.2-java                1.2.17-8+deb10u1ubuntu0.2\n\nUbuntu 16.04 ESM:\n  liblog4j1.2-java                1.2.17-7ubuntu1+esm1\n\nIn general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202402-16\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: Apache Log4j: Multiple Vulnerabilities\n     Date: February 18, 2024\n     Bugs: #719146\n       ID: 202402-16\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been discovered in Apache Log4j, the worst\nof which can lead to remote code execution. \n\nBackground\n==========\n\nLog4j is a Java logging framework that supports various use cases with a\nrich set of components, a separate API, and a performance-optimized\nimplementation. \n\nAffected packages\n=================\n\nPackage         Vulnerable    Unaffected\n--------------  ------------  ------------\ndev-java/log4j  \u003c= 1.2.17     Vulnerable!\n\nDescription\n===========\n\nMultiple vulnerabilities hav been discovered in Apache Log4j. Please\nreview the CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nGentoo has discontinued support for log4j. We recommend that users\nunmerge it:\n\n  # emerge --ask --depclean \"dev-java/log4j\"\n\nReferences\n==========\n\n[ 1 ] CVE-2019-17571\n      https://nvd.nist.gov/vuln/detail/CVE-2019-17571\n[ 2 ] CVE-2020-9488\n      https://nvd.nist.gov/vuln/detail/CVE-2020-9488\n[ 3 ] CVE-2020-9493\n      https://nvd.nist.gov/vuln/detail/CVE-2020-9493\n[ 4 ] CVE-2022-23302\n      https://nvd.nist.gov/vuln/detail/CVE-2022-23302\n[ 5 ] CVE-2022-23305\n      https://nvd.nist.gov/vuln/detail/CVE-2022-23305\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202402-16\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2024 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "db": "PACKETSTORM",
        "id": "165965"
      },
      {
        "db": "PACKETSTORM",
        "id": "165943"
      },
      {
        "db": "PACKETSTORM",
        "id": "168829"
      },
      {
        "db": "PACKETSTORM",
        "id": "167493"
      },
      {
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "db": "PACKETSTORM",
        "id": "177171"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-17571",
        "trust": 3.3
      },
      {
        "db": "PACKETSTORM",
        "id": "159173",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "167493",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "165965",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "165943",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.0599",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3154",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0120.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.2010",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1427",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0098",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0120",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022021415",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022010302",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022021018",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022072128",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022072503",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022012001",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-149831",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17571",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "168829",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "171759",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "177171",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "db": "PACKETSTORM",
        "id": "165965"
      },
      {
        "db": "PACKETSTORM",
        "id": "165943"
      },
      {
        "db": "PACKETSTORM",
        "id": "168829"
      },
      {
        "db": "PACKETSTORM",
        "id": "167493"
      },
      {
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "db": "PACKETSTORM",
        "id": "177171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "id": "VAR-201912-0889",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:01:39.058000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "[jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E"
      },
      {
        "title": "[jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E"
      },
      {
        "title": "[jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E"
      },
      {
        "title": "[jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E"
      },
      {
        "title": "[jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E"
      },
      {
        "title": "[CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer",
        "trust": 0.8,
        "url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E"
      },
      {
        "title": "Apache Log4j Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=105686"
      },
      {
        "title": "Red Hat: Important: log4j security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20225053 - Security Advisory"
      },
      {
        "title": "Debian Security Advisories: DSA-4686-1 apache-log4j1.2 -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=9b0c6a9bccfd00e69ffdf79166adb985"
      },
      {
        "title": "Debian CVElist Bug Report Logs: apache-log4j1.2: CVE-2019-17571",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=9b1a2b3bcff03a4370bb153cc1e9d89e"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Data Virtualization 6.4.8.SP2 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20220507 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Data Virtualization 6.4.8.SP1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20220497 - Security Advisory"
      },
      {
        "title": "IBM: Security Bulletin: The vanruability (net.sf.ehcache blocking in FasterXML jackson-databind has an unknown impact) found Network Performance Insight (CVE-2019-17571)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=ef95ec07d1eed2c8e39fcac3eda0652d"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2022-1562",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2022-1562"
      },
      {
        "title": "IBM: Security Bulletin: Vulnerabilities from log4j affect IBM Operations Analytics \u00e2\u20ac\u201c Log Analysis (CVE-2019-17571, CVE-2020-9488)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=50fa9043c45905a52ed66dfe1c3ccd01"
      },
      {
        "title": "IBM: Security Bulletin: Vulnerabilities in Apache Commons and Log4j affect IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=b53b65c38e4d1ebaa2753d9afd7fa517"
      },
      {
        "title": "IBM: Security Bulletin: Due to use of Apache Log4j, IBM QRadar SIEM is vulnerable to arbitrary code execution (CVE-2019-17571, CVE-2021-44832, CVE-2021-4104)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=a0cbd5f5df3a9f322684d99eeb2b9429"
      },
      {
        "title": "Hello World for Apache Wicket 6.31.0-SNAPSHOT",
        "trust": 0.1,
        "url": "https://github.com/mahiratan/apache "
      },
      {
        "title": "Deprecated",
        "trust": 0.1,
        "url": "https://github.com/michaeltandy/log4j-json "
      },
      {
        "title": "FloreantPOS",
        "trust": 0.1,
        "url": "https://github.com/fat-tire/floreantpos "
      },
      {
        "title": "Hello World for Apache Wicket 6.31.0-SNAPSHOT",
        "trust": 0.1,
        "url": "https://github.com/RajuYelagattu/gopi "
      },
      {
        "title": "Hello World for Apache Wicket 6.31.0-SNAPSHOT",
        "trust": 0.1,
        "url": "https://github.com/janimakinen/hello-world-apache-wicket "
      },
      {
        "title": "Fix-Signature Tracking (FixSigTrack)",
        "trust": 0.1,
        "url": "https://github.com/sa-ne/FixSigTrack "
      },
      {
        "title": "OPEN HTML TO PDF",
        "trust": 0.1,
        "url": "https://github.com/orgTestCodacy11KRepos110MB/repo-5360-openhtmltopdf "
      },
      {
        "title": "Log4j RELP Plugin",
        "trust": 0.1,
        "url": "https://github.com/teragrep/jla_05 "
      },
      {
        "title": "log4j-scanner",
        "trust": 0.1,
        "url": "https://github.com/bluestoneag/log4j-scanner "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/shadow-horse/CVE-2019-17571 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-502",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17571"
      },
      {
        "trust": 1.7,
        "url": "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3cdev.logging.apache.org%3e"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20200110-0001/"
      },
      {
        "trust": 1.7,
        "url": "https://www.debian.org/security/2020/dsa-4686"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"
      },
      {
        "trust": 1.7,
        "url": "https://usn.ubuntu.com/4495-1/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3ccommits.druid.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3ccommits.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3cuser.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3cdev.tinkerpop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3ccommon-dev.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3cpluto-scm.portals.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3clog4j-user.logging.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3cdev.jena.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://access.redhat.com/security/cve/cve-2019-17571"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17571"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3cusers.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3ccommits.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3ccommits.druid.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3ccommon-dev.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3ccommon-issues.hadoop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3cdev.jena.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3clog4j-user.logging.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3cpluto-dev.portals.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3cpluto-scm.portals.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3cdev.tika.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3cdev.tinkerpop.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3cuser.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://www.debian.org/lts/security/2020/dla-2064"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-202014267-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200053-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200054-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.2010"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-for-manufacturing-2-0-is-affected-by-vulnerabilities-of-log4j-1-2-17-log4j-deserialization-remote-code-execution-cve-2019-17571/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1427/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/165965/red-hat-security-advisory-2022-0507-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0120.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0098/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-warehouse-has-released-a-fix-in-response-to-multiple-vulnerabilities-found-in-ibm-db2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-db2-that-affect-the-ibm-performance-management-product/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0120/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-commons-and-log4j-affect-ibm-spectrum-protect-backup-archive-client-and-ibm-spectrum-protect-for-virtual-environments-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact-is-affected-by-an-apache-log4j-vulnerability-cve-2019-17571/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/159173/ubuntu-security-notice-usn-4495-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-the-vanruability-net-sf-ehcache-blocking-in-fasterxml-jackson-databind-has-an-unknown-impact-found-network-performance-insight-cve-2019-17571/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022072503"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022072128"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6519984"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.0599"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/167493/red-hat-security-advisory-2022-5053-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-application-server-liberty-ibm-java-runtime-log4j-and-apache-commons-affect-ibm-spectrum-protect-snapshot-for-vmware/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-log4j-affects-ibm-lks-art-agent/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-found-in-apache-log4j-v1-x-may-affect-ibm-enterprise-records/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022021018"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022021415"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerability-affects-ibm-spectrum-control-formerly-tivoli-storage-productivity-center-cve-2019-17571/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-publicly-disclosed-vulnerability/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/apache-log4j-1-2-code-execution-via-socket-server-deserialization-31193"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022012001"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/165943/red-hat-security-advisory-2022-0497-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022010302"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3154/"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-23302"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-23305"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9488"
      },
      {
        "trust": 0.3,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-23307"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-9488"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/site/solutions/625683)"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2022-23307"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=data.services.platform\u0026downloadtype=securitypatches\u0026version=6.4"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-4104"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-4104"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2022-23305"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2022-23302"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4495-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1build0.18.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:0507"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:0497"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/apache-log4j1.2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:5053"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-5998-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-9ubuntu0.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache-log4j1.2/1.2.17-8+deb10u1ubuntu0.2"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/glsa/202402-16"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9493"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "db": "PACKETSTORM",
        "id": "165965"
      },
      {
        "db": "PACKETSTORM",
        "id": "165943"
      },
      {
        "db": "PACKETSTORM",
        "id": "168829"
      },
      {
        "db": "PACKETSTORM",
        "id": "167493"
      },
      {
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "db": "PACKETSTORM",
        "id": "177171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "db": "PACKETSTORM",
        "id": "165965"
      },
      {
        "db": "PACKETSTORM",
        "id": "165943"
      },
      {
        "db": "PACKETSTORM",
        "id": "168829"
      },
      {
        "db": "PACKETSTORM",
        "id": "167493"
      },
      {
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "db": "PACKETSTORM",
        "id": "177171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "date": "2019-12-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "date": "2020-01-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "date": "2020-09-15T17:05:37",
        "db": "PACKETSTORM",
        "id": "159173"
      },
      {
        "date": "2022-02-11T15:46:06",
        "db": "PACKETSTORM",
        "id": "165965"
      },
      {
        "date": "2022-02-10T16:17:02",
        "db": "PACKETSTORM",
        "id": "165943"
      },
      {
        "date": "2020-05-28T19:12:00",
        "db": "PACKETSTORM",
        "id": "168829"
      },
      {
        "date": "2022-06-20T00:19:05",
        "db": "PACKETSTORM",
        "id": "167493"
      },
      {
        "date": "2023-04-06T14:37:27",
        "db": "PACKETSTORM",
        "id": "171759"
      },
      {
        "date": "2024-02-19T14:10:03",
        "db": "PACKETSTORM",
        "id": "177171"
      },
      {
        "date": "2019-12-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "date": "2019-12-20T17:15:11.893000",
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-12-14T00:00:00",
        "db": "VULHUB",
        "id": "VHN-149831"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-17571"
      },
      {
        "date": "2020-01-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      },
      {
        "date": "2023-04-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      },
      {
        "date": "2024-11-21T04:32:33.393000",
        "db": "NVD",
        "id": "CVE-2019-17571"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "177171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Log4j Vulnerable to unreliable data deserialization",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-013606"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-950"
      }
    ],
    "trust": 0.6
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache log4j ist ein Framework zum Loggen von Anwendungsmeldungen in Java.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0368 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0368.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0368 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0368"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5053 vom 2022-06-16",
        "url": "https://access.redhat.com/errata/RHSA-2022:5053"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5998-1 vom 2023-04-06",
        "url": "https://ubuntu.com/security/notices/USN-5998-1"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7152257 vom 2024-05-15",
        "url": "https://www.ibm.com/support/pages/node/7152257"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Log4j: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2024-05-14T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:28:47.185+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-0368",
      "initial_release_date": "2022-06-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-06-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-04-05T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2024-05-14T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.2",
                "product": {
                  "name": "Apache log4j 1.2",
                  "product_id": "T021343",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:log4j:1.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "log4j"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.5",
                "product": {
                  "name": "IBM QRadar SIEM 7.5",
                  "product_id": "T022954",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6 Extended Lifecycle Support",
                "product": {
                  "name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support",
                  "product_id": "T021834",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6_extended_lifecycle_support"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17571",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Apache log4j. Der Fehler besteht aufgrund der Deserialisierung von nicht vertrauensw\u00fcrdigen Daten. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022954",
          "T021834",
          "T000126",
          "T021343"
        ]
      },
      "release_date": "2022-06-16T22:00:00.000+00:00",
      "title": "CVE-2019-17571"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erh\u00f6hen oder einen Denial of Service zu verursachen",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0770 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2022-0770.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0770 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0770"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6198380 vom 2020-04-23",
        "url": "https://www.ibm.com/support/pages/node/6198380"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:2603 vom 2020-06-17",
        "url": "https://access.redhat.com/errata/RHSA-2020:2603"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:4807 vom 2020-11-04",
        "url": "https://access.redhat.com/errata/RHSA-2020:4807"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2021:3225 vom 2021-08-20",
        "url": "https://access.redhat.com/errata/RHSA-2021:3225"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-115 vom 2022-05-27",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-115/index.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6605881 vom 2022-07-21",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-144/index.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-070 vom 2024-02-03",
        "url": "https://www.dell.com/support/kbdoc/000221770/dsa-2024-="
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7153639 vom 2024-05-17",
        "url": "https://www.ibm.com/support/pages/node/7153639"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7256605 vom 2026-01-09",
        "url": "https://www.ibm.com/support/pages/node/7256605"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM DB2: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-08T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-09T07:40:17.215+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2022-0770",
      "initial_release_date": "2020-04-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2020-04-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2020-06-17T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2020-11-03T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2021-08-19T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-26T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2022-07-20T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2024-02-04T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-05-16T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-01-08T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "EMC Avamar",
            "product": {
              "name": "EMC Avamar",
              "product_id": "T014381",
              "product_identification_helper": {
                "cpe": "cpe:/a:emc:avamar:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Hitachi Ops Center",
                "product": {
                  "name": "Hitachi Ops Center",
                  "product_id": "T017562",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cAnalyzer 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003cAnalyzer 10.9.3-00",
                  "product_id": "T030196"
                }
              },
              {
                "category": "product_version",
                "name": "Analyzer 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center Analyzer 10.9.3-00",
                  "product_id": "T030196-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:analyzer_10.9.3-00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cViewpoint 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003cViewpoint 10.9.3-00",
                  "product_id": "T030197"
                }
              },
              {
                "category": "product_version",
                "name": "Viewpoint 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center Viewpoint 10.9.3-00",
                  "product_id": "T030197-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:viewpoint_10.9.3-00"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Ops Center"
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.1",
                "product": {
                  "name": "IBM DB2 11.1",
                  "product_id": "342000",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:11.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "11.5",
                "product": {
                  "name": "IBM DB2 11.5",
                  "product_id": "695419",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:11.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DB2"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Analytic Server",
                "product": {
                  "name": "IBM SPSS Analytic Server",
                  "product_id": "T011787",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:analytic_server"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-0001",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2009-0001"
    },
    {
      "cve": "CVE-2014-0114",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-0114"
    },
    {
      "cve": "CVE-2014-0193",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-0193"
    },
    {
      "cve": "CVE-2014-3488",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-3488"
    },
    {
      "cve": "CVE-2015-2156",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2015-2156"
    },
    {
      "cve": "CVE-2016-2402",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2016-2402"
    },
    {
      "cve": "CVE-2017-12972",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12972"
    },
    {
      "cve": "CVE-2017-12973",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12973"
    },
    {
      "cve": "CVE-2017-12974",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12974"
    },
    {
      "cve": "CVE-2017-18640",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-18640"
    },
    {
      "cve": "CVE-2017-3734",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-3734"
    },
    {
      "cve": "CVE-2017-5637",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-5637"
    },
    {
      "cve": "CVE-2018-10237",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-10237"
    },
    {
      "cve": "CVE-2018-11771",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-11771"
    },
    {
      "cve": "CVE-2018-8009",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-8009"
    },
    {
      "cve": "CVE-2018-8012",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-8012"
    },
    {
      "cve": "CVE-2019-0201",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-0201"
    },
    {
      "cve": "CVE-2019-10086",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10086"
    },
    {
      "cve": "CVE-2019-10172",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10172"
    },
    {
      "cve": "CVE-2019-10202",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10202"
    },
    {
      "cve": "CVE-2019-12402",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-12402"
    },
    {
      "cve": "CVE-2019-16869",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-16869"
    },
    {
      "cve": "CVE-2019-17195",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-17195"
    },
    {
      "cve": "CVE-2019-17571",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-17571"
    },
    {
      "cve": "CVE-2019-9512",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9512"
    },
    {
      "cve": "CVE-2019-9514",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9514"
    },
    {
      "cve": "CVE-2019-9515",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9515"
    },
    {
      "cve": "CVE-2019-9518",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9518"
    }
  ]
}