Skip to content
OpenAdvisories
Critical RHSA-2022:5053 1 CVE

Red Hat Security Advisory: log4j security update

Published Sep 20, 2024 · Updated Aug 9, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 6 ELS rhel_els:6 log4j 0:1.2.14-6.7.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-debuginfo 0:1.2.14-6.7.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-javadoc 0:1.2.14-6.7.el6_10
Red Hat · RHEL 6 ELS rhel_els:6 log4j-manual 0:1.2.14-6.7.el6_10

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-17571 Public exploit EPSS 70%

    Deserialization of Untrusted Data in Log4j

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

    Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1785616
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5053.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-17571
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17571
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17571