Sign-up

ID

VAR-202112-2011


CVE

CVE-2021-44832


TITLE

Apache Log4j Input validation error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202112-2743

DESCRIPTION

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. Apache Log4j is a Java-based open source logging tool of the Apache Foundation. Apache Log4j2 2.0-beta7 to 2.17.0 versions have a security vulnerability, which stems from the lack of effective protection and filtering for JDBC Appender and JNDI in the software. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Installation instructions are available from the Fuse product documentation pages: Fuse 7.8: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/deploying_into_spring_boot/patch-red-hat-fuse-applications Fuse 7.9: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/deploying_into_spring_boot/patch-red-hat-fuse-applications Fuse 7.10: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/deploying_into_spring_boot/patch-red-hat-fuse-applications 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat build of Eclipse Vert.x 4.1.8 security update Advisory ID: RHSA-2022:0083-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2022:0083 Issue date: 2022-01-20 CVE Names: CVE-2021-44832 CVE-2021-45046 CVE-2021-45105 ==================================================================== 1. Summary: An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE pages listed in the References section. 2. Description: This release of Red Hat build of Eclipse Vert.x 4.1.8 GA includes security updates. For more information, see the release notes listed in the References section. Security Fix(es): * log4j-core: remote code execution via JDBC Appender (CVE-2021-44832) * log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046) * log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 2032580 - CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) 2034067 - CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern 2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender 5. References: https://access.redhat.com/security/cve/CVE-2021-44832 https://access.redhat.com/security/cve/CVE-2021-45046 https://access.redhat.com/security/cve/CVE-2021-45105 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product\xcatRhoar.eclipse.vertx&version=4.1.8 https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.1/html/release_notes_for_eclipse_vert.x_4.1/index 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYemZRNzjgjWX9erEAQg3kg//TMRnMbFneaojfw2Cav3ewH7CQEqai/UQ 4nb5leVBZUlkoGk302d1Xlmjc8oYeyRHP2w95PuWfSqxpU5GhOabUjlJzul1Um34 Y0QaFhBI7xuAk28szn7JKoB6yZ6UAgB/vmYYo0YdlphtInAwnp3Vipb/3vgzXJUH eaFAkTvEMc4h0gcyLO98Krr/4u87+YJyY2wbWSpRDoQpQUcnDzGNqessOp6NMSsS mo0SHcFVYLXqsM9/cHaQyhIfTlF5JDApe0DO5y1zE60B1tYJyU34fgoRprFs5ybv f4Enn/qVWfmx2PCdEwOdKvjf2jQzVplqbPQwxILMRN2f3+y7OBNNWPB16kTskP3u jYUXZd6AN+YdJBzpBw23TFDmtSbGn9A3jTOWz1uACu3vYxNPSzDYIkOgD0hYfNIb dZntht5p3WgkBQ0Xkgd0At2UXwc70eJ2uH51Ck/bosH46MuKzVSeCoAsCCEXRMTm vGsfK5EV8Es5ltzsw1Im+3DZ8QcBNN7SUWidrJa9d6U9F0pzZVe1co4D12Xchapv bxQp0QeWHIgFNBQA8vQk6SZsdJH3THzHi0GUzLvSMED02MsfAd7HQhyndu/b9vs6 s2OIgauHd09+Siw1twydZUg1eEbeNctFUW2pi2LRggCY4cqLA0j4l0q0zQnKCdw3 73/w3ORRBdI=mx2F -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. JIRA issues fixed (https://issues.jboss.org/): JBEAP-22105 - (7.4.z) Upgrade from com.io7m.xom:xom 1.2.10 to xom:xom 1.3.7 JBEAP-22385 - (7.4.z) Upgrade ASM from 7.1 to 9.1 JBEAP-22731 - (7.4.z) Upgrade Artemis from 2.16.0.redhat-00032 to 2.16.0.redhat-00034 JBEAP-22738 - (7.4.z) Upgrade jbossws-cxf from 5.4.2.Final to 5.4.4.Final(Fix UsernameTokenElytronTestCase on SE 17) JBEAP-22819 - [GSS] (7.4.z) HAL-1762 - Aliases are removed from the credential store when passwords are updated from the admin console JBEAP-22839 - [GSS](7.4.z) Upgrade yasson from 1.0.9.redhat-00001 to 1.0.10.redhat-00001 JBEAP-22864 - (7.4.z) Upgrade HAL from 3.3.8.Final-redhat-00001 to 3.3.9.Final-redhat-00001 JBEAP-22904 - (7.4.z) Upgrade Hibernate ORM from 5.3.24.Final-redhat-00001 to 5.3.25.Final-redhat-00002 JBEAP-22911 - (7.4.z) Upgrade OpenSSL from 2.1.3.Final-redhat-00001 to 2.2.0.Final-redhat-00001 JBEAP-22912 - (7.4.z) Upgrade OpenSSL Natives from 2.1.0.SP01-redhat-00001 to 2.2.0.Final-redhat-00001 JBEAP-22913 - (7.4.z) Upgrade WildFly Core from 15.0.6.Final-redhat-00003 to 15.0.7.Final-redhat-00001 JBEAP-22935 - (7.4.z) Upgrade jboss-vfs from 3.2.15.Final-redhat-00001 to 3.2.16.Final-redhat-00001 JBEAP-22945 - (7.4.z) Upgrade org.apache.logging.log4j from 2.14.0.redhat-00002 to 2.17.1.redhat-00001 JBEAP-22973 - (7.4.z) Upgrade Elytron from 1.15.9.Final-redhat-00001 to 1.15.11.Final-redhat-00002 JBEAP-23038 - (7.4.z) Upgrade galleon-plugins from 5.1.4.Final to 5.2.6.Final JBEAP-23040 - (7.4.z) Upgrade galleon-plugins in wildfly-core-eap from 5.1.4.Final to 5.2.6.Final JBEAP-23045 - (7.4.z) Upgrade Undertow from 2.2.13.SP2-redhat-00001 to 2.2.16.Final-redhat-0001 JBEAP-23101 - (7.4.z) Upgrade Infinispan from 11.0.12.Final to 11.0.15.Final JBEAP-23105 - (7.4.z) Upgrade Narayana from 5.11.3.Final-redhat-00001 to 5.11.4.Final-redhat-00001 JBEAP-23143 - (7.4.z) Upgrade from org.eclipse.jdt.core.compiler:ecj:4.6.1 to org.eclipse.jdt:ecj:3.26 JBEAP-23177 - (7.4.z) Upgrade XNIO from 3.8.5.SP1-redhat-00001 to 3.8.6.Final-redhat-00001 JBEAP-23323 - [GSS](7.4.z) WFLY-16112 - Batch JobOperatorService should look for only active job names to stop during suspend JBEAP-23373 - (7.4.z) Upgrade OpenSSL from 2.2.0.Final-redhat-00001 to 2.2.0.Final-redhat-00002 JBEAP-23374 - (7.4.z) Upgrade WildFly Core from 15.0.7.Final-redhat-00001 to 15.0.8.Final-redhat-00001 JBEAP-23375 - (7.4.z) Upgrade OpenSSL Natives from 2.2.0.Final-redhat-00001 to 2.2.0.Final-redhat-00002 6. Description: Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. Bugs fixed (https://bugzilla.redhat.com/): 1985223 - CVE-2021-34429 jetty: crafted URIs allow bypassing security constraints 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2009041 - CVE-2021-38153 Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients 2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender 5. All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender 5

Trust: 1.71

sources: NVD: CVE-2021-44832 // VULHUB: VHN-408213 // PACKETSTORM: 165632 // PACKETSTORM: 165637 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // PACKETSTORM: 165653 // PACKETSTORM: 165651 // PACKETSTORM: 165564 // PACKETSTORM: 166020

AFFECTED PRODUCTS

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.3.0.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:gteversion:19.12.0

Trust: 1.0

vendor:ciscomodel:cloudcenterscope:eqversion:4.10.0.16

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:34

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:35

Trust: 1.0

vendor:oraclemodel:communications offline mediation controllerscope:ltversion:12.0.0.4.4

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:gteversion:18.8.0

Trust: 1.0

vendor:oraclemodel:policy automation for mobile devicesscope:gteversion:12.2.0

Trust: 1.0

vendor:oraclemodel:retail order brokerscope:eqversion:19.1

Trust: 1.0

vendor:oraclemodel:policy automation for mobile devicesscope:lteversion:12.2.24

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:oraclemodel:siebel ui frameworkscope:lteversion:21.12

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:20.0.1

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:lteversion:17.12.11

Trust: 1.0

vendor:apachemodel:log4jscope:gteversion:2.0.1

Trust: 1.0

vendor:oraclemodel:retail fiscal managementscope:eqversion:14.2

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:17.0.4

Trust: 1.0

vendor:oraclemodel:communications interactive session recorderscope:eqversion:6.4

Trust: 1.0

vendor:apachemodel:log4jscope:ltversion:2.17.1

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.5.1.0

Trust: 1.0

vendor:oraclemodel:weblogic serverscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:oraclemodel:communications brm - elastic charging enginescope:eqversion:12.0.0.5.0

Trust: 1.0

vendor:oraclemodel:policy automationscope:gteversion:12.2.0

Trust: 1.0

vendor:oraclemodel:retail order brokerscope:eqversion:18.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:lteversion:19.12.18.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:gteversion:20.12.0.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:21.12

Trust: 1.0

vendor:oraclemodel:health sciences data management workbenchscope:eqversion:3.1.0.3

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:19.12

Trust: 1.0

vendor:oraclemodel:product lifecycle analyticsscope:eqversion:3.6.1

Trust: 1.0

vendor:oraclemodel:weblogic serverscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:oraclemodel:policy automationscope:lteversion:12.2.24

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:gteversion:19.12.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:18.8

Trust: 1.0

vendor:oraclemodel:flexcube private bankingscope:eqversion:12.1.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:lteversion:19.12.12

Trust: 1.0

vendor:apachemodel:log4jscope:gteversion:2.4

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:21.0.1

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:lteversion:18.8.13

Trust: 1.0

vendor:oraclemodel:weblogic serverscope:eqversion:14.1.1.0.0

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:18.0.3

Trust: 1.0

vendor:apachemodel:log4jscope:gteversion:2.13.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:gteversion:20.12.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:lteversion:20.12.12.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:21.12.0.0

Trust: 1.0

vendor:oraclemodel:retail assortment planningscope:eqversion:16.0.3

Trust: 1.0

vendor:oraclemodel:health sciences data management workbenchscope:eqversion:3.0.0.0

Trust: 1.0

vendor:oraclemodel:communications interactive session recorderscope:eqversion:6.3

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:20.12

Trust: 1.0

vendor:oraclemodel:health sciences data management workbenchscope:eqversion:2.5.2.1

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:19.0.2

Trust: 1.0

vendor:oraclemodel:communications brm - elastic charging enginescope:ltversion:12.0.0.4.6

Trust: 1.0

vendor:apachemodel:log4jscope:ltversion:2.3.2

Trust: 1.0

vendor:apachemodel:log4jscope:eqversion:2.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:eqversion:21.12.0

Trust: 1.0

vendor:oraclemodel:siebel ui frameworkscope:eqversion:21.12

Trust: 1.0

vendor:apachemodel:log4jscope:ltversion:2.12.4

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:gteversion:19.12.0.0

Trust: 1.0

vendor:oraclemodel:communications offline mediation controllerscope:eqversion:12.0.0.5.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:lteversion:20.12.7

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0.0

Trust: 1.0

vendor:oraclemodel:primavera gatewayscope:gteversion:17.12.0

Trust: 1.0

sources: NVD: CVE-2021-44832

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-44832
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202112-2743
value: MEDIUM

Trust: 0.6

VULHUB: VHN-408213
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-44832
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.8
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-408213
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.8
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-44832
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.7
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-408213 // CNNVD: CNNVD-202112-2743 // NVD: CVE-2021-44832

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-74

Trust: 1.0

sources: VULHUB: VHN-408213 // NVD: CVE-2021-44832

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 166673 // CNNVD: CNNVD-202112-2743

TYPE

code execution

Trust: 0.7

sources: PACKETSTORM: 165632 // PACKETSTORM: 165637 // PACKETSTORM: 165649 // PACKETSTORM: 165653 // PACKETSTORM: 165651 // PACKETSTORM: 165564 // PACKETSTORM: 166020

PATCH

title:Apache Log4j Repair measures for injecting vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=178606

Trust: 0.6

sources: CNNVD: CNNVD-202112-2743

EXTERNAL IDS

db:NVDid:CVE-2021-44832

Trust: 2.5

db:SIEMENSid:SSA-784507

Trust: 1.7

db:OPENWALLid:OSS-SECURITY/2021/12/28/1

Trust: 1.7

db:PACKETSTORMid:165564

Trust: 0.8

db:PACKETSTORMid:165516

Trust: 0.7

db:PACKETSTORMid:165652

Trust: 0.7

db:PACKETSTORMid:166022

Trust: 0.7

db:PACKETSTORMid:165750

Trust: 0.7

db:PACKETSTORMid:165927

Trust: 0.7

db:PACKETSTORMid:165659

Trust: 0.7

db:PACKETSTORMid:165645

Trust: 0.7

db:PACKETSTORMid:165711

Trust: 0.7

db:CNNVDid:CNNVD-202112-2743

Trust: 0.7

db:PACKETSTORMid:166676

Trust: 0.6

db:PACKETSTORMid:166677

Trust: 0.6

db:CS-HELPid:SB2022010712

Trust: 0.6

db:CS-HELPid:SB2022012327

Trust: 0.6

db:CS-HELPid:SB2022042551

Trust: 0.6

db:CS-HELPid:SB2021122816

Trust: 0.6

db:CS-HELPid:SB2022011042

Trust: 0.6

db:CS-HELPid:SB2022072092

Trust: 0.6

db:CS-HELPid:SB2022021635

Trust: 0.6

db:CS-HELPid:SB2022012441

Trust: 0.6

db:CS-HELPid:SB2022011223

Trust: 0.6

db:CS-HELPid:SB2022041951

Trust: 0.6

db:CS-HELPid:SB2022072040

Trust: 0.6

db:CS-HELPid:SB2022011837

Trust: 0.6

db:CS-HELPid:SB2022060307

Trust: 0.6

db:CS-HELPid:SB2022072504

Trust: 0.6

db:CS-HELPid:SB2022012046

Trust: 0.6

db:CS-HELPid:SB2022012516

Trust: 0.6

db:CS-HELPid:SB2022012745

Trust: 0.6

db:CS-HELPid:SB2022021423

Trust: 0.6

db:CS-HELPid:SB2022010632

Trust: 0.6

db:CS-HELPid:SB2022060906

Trust: 0.6

db:CS-HELPid:SB2021123002

Trust: 0.6

db:CS-HELPid:SB2022011719

Trust: 0.6

db:CS-HELPid:SB2022020605

Trust: 0.6

db:CS-HELPid:SB2022042211

Trust: 0.6

db:CS-HELPid:SB2022032405

Trust: 0.6

db:CS-HELPid:SB2022020907

Trust: 0.6

db:LENOVOid:LEN-76573

Trust: 0.6

db:AUSCERTid:ESB-2022.0332

Trust: 0.6

db:AUSCERTid:ESB-2022.0351

Trust: 0.6

db:AUSCERTid:ESB-2022.0125

Trust: 0.6

db:AUSCERTid:ESB-2022.0247

Trust: 0.6

db:AUSCERTid:ESB-2022.0037

Trust: 0.6

db:AUSCERTid:ESB-2022.0685

Trust: 0.6

db:AUSCERTid:ESB-2022.0308

Trust: 0.6

db:AUSCERTid:ESB-2022.0395

Trust: 0.6

db:AUSCERTid:ESB-2022.0045

Trust: 0.6

db:AUSCERTid:ESB-2022.0195

Trust: 0.6

db:AUSCERTid:ESB-2022.0044.2

Trust: 0.6

db:PACKETSTORMid:165653

Trust: 0.2

db:PACKETSTORMid:166020

Trust: 0.2

db:PACKETSTORMid:165637

Trust: 0.2

db:PACKETSTORMid:165651

Trust: 0.2

db:PACKETSTORMid:165649

Trust: 0.2

db:PACKETSTORMid:165632

Trust: 0.2

db:PACKETSTORMid:165636

Trust: 0.1

db:PACKETSTORMid:165650

Trust: 0.1

db:VULHUBid:VHN-408213

Trust: 0.1

db:PACKETSTORMid:166673

Trust: 0.1

sources: VULHUB: VHN-408213 // PACKETSTORM: 165632 // PACKETSTORM: 165637 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // PACKETSTORM: 165653 // PACKETSTORM: 165651 // PACKETSTORM: 165564 // PACKETSTORM: 166020 // CNNVD: CNNVD-202112-2743 // NVD: CVE-2021-44832

REFERENCES

url:https://www.oracle.com/security-alerts/cpuapr2022.html

Trust: 2.3

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-apache-log4j-qruknebd

Trust: 1.7

url:https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20220104-0001/

Trust: 1.7

url:https://issues.apache.org/jira/browse/log4j2-3293

Trust: 1.7

url:https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143

Trust: 1.7

url:https://www.oracle.com/security-alerts/cpujan2022.html

Trust: 1.7

url:https://www.oracle.com/security-alerts/cpujul2022.html

Trust: 1.7

url:https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html

Trust: 1.7

url:http://www.openwall.com/lists/oss-security/2021/12/28/1

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-44832

Trust: 1.4

url:https://access.redhat.com/security/cve/cve-2021-44832

Trust: 1.4

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/evv25fxl4fu5x6x5bsl7rlq7t6f65mra/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/t57mpjuw3ma6qgwzrtmchhmmpqnvkgfc/

Trust: 1.0

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.8

url:https://bugzilla.redhat.com/):

Trust: 0.8

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/t57mpjuw3ma6qgwzrtmchhmmpqnvkgfc/

Trust: 0.7

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/evv25fxl4fu5x6x5bsl7rlq7t6f65mra/

Trust: 0.7

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0125

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0685

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0045

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011837

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb20220422119

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011719

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022020907

Trust: 0.6

url:https://packetstormsecurity.com/files/165645/red-hat-security-advisory-2022-0205-02.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021122816

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010712

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011042

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010632

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072504

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0037

Trust: 0.6

url:https://packetstormsecurity.com/files/165750/red-hat-security-advisory-2022-0181-05.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166676/red-hat-security-advisory-2022-1297-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/165564/red-hat-security-advisory-2022-0138-06.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0351

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0395

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0195

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072040

Trust: 0.6

url:https://packetstormsecurity.com/files/165927/red-hat-security-advisory-2022-0467-02.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022012745

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb20220422115

Trust: 0.6

url:https://packetstormsecurity.com/files/165711/red-hat-security-advisory-2022-0236-04.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0308

Trust: 0.6

url:https://packetstormsecurity.com/files/165516/ubuntu-security-notice-usn-5222-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022060906

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022060307

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022021423

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022041951

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072092

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022020605

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022012516

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021123002

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032405

Trust: 0.6

url:https://packetstormsecurity.com/files/165652/red-hat-security-advisory-2022-0225-02.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011223

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0332

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022042551

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0044.2

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022021635

Trust: 0.6

url:https://vigilance.fr/vulnerability/apache-log4j-code-execution-via-jdbc-appender-logging-configuration-file-37144

Trust: 0.6

url:https://packetstormsecurity.com/files/165659/red-hat-security-advisory-2022-0230-03.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166022/red-hat-security-advisory-2022-0485-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022012327

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022012441

Trust: 0.6

url:https://support.lenovo.com/us/en/product_security/len-76573

Trust: 0.6

url:https://packetstormsecurity.com/files/166677/red-hat-security-advisory-2022-1296-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022012046

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0247

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-45046

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-45105

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-45105

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-45046

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-27292

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-27292

Trust: 0.2

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/deploying_into_spring_boot/patch-red-hat-fuse-applications

Trust: 0.1

url:https://access.redhat.com/security/vulnerabilities/rhsb-2021-009

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/installing_on_apache_karaf/apply-hotfix-patch

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=jboss.fuse&version=7.09.0

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/installing_on_apache_karaf/apply-hotfix-patch

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=jboss.fuse&version=7.10.0

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/installing_on_apache_karaf/apply-hotfix-patch

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/deploying_into_spring_boot/patch-red-hat-fuse-applications

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44228

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#critical

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44228

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0203

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=jboss.fuse&version=7.08.0

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/deploying_into_spring_boot/patch-red-hat-fuse-applications

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0083

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product\xcatrhoar.eclipse.vertx&version=4.1.8

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.1/html/release_notes_for_eclipse_vert.x_4.1/index

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1

Trust: 0.1

url:https://access.redhat.com/articles/11258

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0222

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=red.hat.integration&version

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23307

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23302

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches&product=appplatform&version=7.4

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23305

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4104

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1299

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-23302

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#low

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-23305

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-23307

Trust: 0.1

url:https://issues.jboss.org/):

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4104

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0227

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0226

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-37136

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-37137

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-37137

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-37136

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-34429

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-38153

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.amq.streams&version=2.0.0

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-34429

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0138

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-38153

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21248

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3521

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21296

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21299

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21283

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21341

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21360

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21299

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0493

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21282

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21294

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21360

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21305

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21293

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21341

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21293

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0492

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21282

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21248

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21294

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21283

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21296

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21365

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21305

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21340

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21340

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21365

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3521

Trust: 0.1

sources: VULHUB: VHN-408213 // PACKETSTORM: 165632 // PACKETSTORM: 165637 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // PACKETSTORM: 165653 // PACKETSTORM: 165651 // PACKETSTORM: 165564 // PACKETSTORM: 166020 // CNNVD: CNNVD-202112-2743 // NVD: CVE-2021-44832

CREDITS

Red Hat

Trust: 0.8

sources: PACKETSTORM: 165632 // PACKETSTORM: 165637 // PACKETSTORM: 165649 // PACKETSTORM: 166673 // PACKETSTORM: 165653 // PACKETSTORM: 165651 // PACKETSTORM: 165564 // PACKETSTORM: 166020

SOURCES

db:VULHUBid:VHN-408213
db:PACKETSTORMid:165632
db:PACKETSTORMid:165637
db:PACKETSTORMid:165649
db:PACKETSTORMid:166673
db:PACKETSTORMid:165653
db:PACKETSTORMid:165651
db:PACKETSTORMid:165564
db:PACKETSTORMid:166020
db:CNNVDid:CNNVD-202112-2743
db:NVDid:CVE-2021-44832

LAST UPDATE DATE

2026-02-07T20:15:37.748000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-408213date:2022-08-09T00:00:00
db:CNNVDid:CNNVD-202112-2743date:2022-12-09T00:00:00
db:NVDid:CVE-2021-44832date:2024-11-21T06:31:34.783

SOURCES RELEASE DATE

db:VULHUBid:VHN-408213date:2021-12-28T00:00:00
db:PACKETSTORMid:165632date:2022-01-20T17:49:05
db:PACKETSTORMid:165637date:2022-01-20T17:50:03
db:PACKETSTORMid:165649date:2022-01-21T15:29:08
db:PACKETSTORMid:166673date:2022-04-11T17:07:22
db:PACKETSTORMid:165653date:2022-01-21T15:31:20
db:PACKETSTORMid:165651date:2022-01-21T15:30:48
db:PACKETSTORMid:165564date:2022-01-14T15:29:02
db:PACKETSTORMid:166020date:2022-02-17T16:54:19
db:CNNVDid:CNNVD-202112-2743date:2021-12-28T00:00:00
db:NVDid:CVE-2021-44832date:2021-12-28T20:15:08.400