Skip to content
OpenAdvisories
High RHSA-2021:5206 1 CVE

Red Hat Security Advisory: log4j security update

Published Sep 20, 2024 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.3 AUS rhel_aus:7.3::server log4j 0:1.2.17-16.el7_3
Red Hat · RHEL 7.3 AUS rhel_aus:7.3::server log4j-javadoc 0:1.2.17-16.el7_3
Red Hat · RHEL 7.3 AUS rhel_aus:7.3::server log4j-manual 0:1.2.17-16.el7_3
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 AUS rhel_aus:7.6::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 AUS rhel_aus:7.6::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 AUS rhel_aus:7.6::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 AUS rhel_aus:7.7::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 AUS rhel_aus:7.7::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 AUS rhel_aus:7.7::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 E4S rhel_e4s:7.6::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 E4S rhel_e4s:7.6::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 E4S rhel_e4s:7.6::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 E4S rhel_e4s:7.7::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 E4S rhel_e4s:7.7::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 E4S rhel_e4s:7.7::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 6 ELS rhel_els:6 log4j 0:1.2.14-6.5.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-debuginfo 0:1.2.14-6.5.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-javadoc 0:1.2.14-6.5.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-manual 0:1.2.14-6.5.el6_10
Red Hat · RHEL 7.6 TUS rhel_tus:7.6::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 TUS rhel_tus:7.6::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.6 TUS rhel_tus:7.6::server log4j-manual 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 TUS rhel_tus:7.7::server log4j 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 TUS rhel_tus:7.7::server log4j-javadoc 0:1.2.17-17.el7_4
Red Hat · RHEL 7.7 TUS rhel_tus:7.7::server log4j-manual 0:1.2.17-17.el7_4

Vulnerabilities 1

  • High 7.5
    CVE-2021-4104 Public exploit EPSS 81%

    Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031667
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5206.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-4104
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-4104
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-4104
  • article
    https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
  • article
    https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
  • article
    https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
  • article
    https://www.openwall.com/lists/oss-security/2021/12/13/1