Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update

Fixed packages 1

Vulnerabilities 7

• Critical 9.0
  CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 14, 2021

  KEV May 1, 2023
• Critical 9.8
  CVE-2022-23305 Public exploit EPSS 67%

  SQL injection in JDBC Appender in Apache Log4j V1

  By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Jan 18, 2022
• High 8.8
  CVE-2022-23302 EPSS 64%

  Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

  JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Top…

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Jan 18, 2022
• High 8.8
  CVE-2022-23307 EPSS 54%

  A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

  CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Jan 18, 2022
• High 7.5
  CVE-2021-4104 Public exploit EPSS 81%

  Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

  JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Dec 14, 2021
• Medium 6.6
  CVE-2021-44832 Public exploit EPSS 98%

  Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

  Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 28, 2021
• Medium 5.9
  CVE-2021-45105 Public exploit EPSS 100%

  Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

  Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

  Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Dec 18, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2031667
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2032580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034067
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2035951
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2041949
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2041959
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2041967
• article
  https://issues.redhat.com/browse/JBEAP-22105
• article
  https://issues.redhat.com/browse/JBEAP-22385
• article
  https://issues.redhat.com/browse/JBEAP-22731
• article
  https://issues.redhat.com/browse/JBEAP-22738
• article
  https://issues.redhat.com/browse/JBEAP-22819
• article
  https://issues.redhat.com/browse/JBEAP-22839
• article
  https://issues.redhat.com/browse/JBEAP-22864
• article
  https://issues.redhat.com/browse/JBEAP-22900
• article
  https://issues.redhat.com/browse/JBEAP-22904
• article
  https://issues.redhat.com/browse/JBEAP-22911
• article
  https://issues.redhat.com/browse/JBEAP-22912
• article
  https://issues.redhat.com/browse/JBEAP-22913
• article
  https://issues.redhat.com/browse/JBEAP-22935
• article
  https://issues.redhat.com/browse/JBEAP-22945
• article
  https://issues.redhat.com/browse/JBEAP-22973
• article
  https://issues.redhat.com/browse/JBEAP-23038
• article
  https://issues.redhat.com/browse/JBEAP-23040
• article
  https://issues.redhat.com/browse/JBEAP-23045
• article
  https://issues.redhat.com/browse/JBEAP-23101
• article
  https://issues.redhat.com/browse/JBEAP-23105
• article
  https://issues.redhat.com/browse/JBEAP-23143
• article
  https://issues.redhat.com/browse/JBEAP-23177
• article
  https://issues.redhat.com/browse/JBEAP-23323
• article
  https://issues.redhat.com/browse/JBEAP-23373
• article
  https://issues.redhat.com/browse/JBEAP-23374
• article
  https://issues.redhat.com/browse/JBEAP-23375
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1297.json
• report
  https://access.redhat.com/security/cve/CVE-2021-4104
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-009