Description
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j 1.x | 1.0.1 – < unspecified, unspecified – < 2.0-alpha1 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 13 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 12 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 9 | apache-log4j1.2 | 1.2.17-7+deb9u2 | DLA-2905-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j1.2 | 1.2.17-9ubuntu0.2 | USN-5998-1 |
| Ubuntu 18.04 LTS | apache-log4j1.2 | 1.2.17-8+deb10u1ubuntu0.2 | USN-5998-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j1.2 | 1.2.17-7ubuntu1+esm1 | USN-5998-1 |
| Ubuntu Pro 14.04 LTS | apache-log4j1.2 | 1.2.17-4ubuntu3+esm2 | USN-7590-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | parfait +3 | 0.5.4-4.module+el8.5.0+13988+de2b8c0b | RHSA-2022:0290 |
| RHEL 8 | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 7 | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 3 | rh-maven36-log4j12 +1 | 1.2.17-23.4.el7 | RHSA-2022:0439 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.10.6-0.1.el8ev | RHSA-2022:0475 |
| Red Hat Rhev Manager 4 | snmp4j +1 | 3.6.4-0.1.el8ev | RHSA-2022:0475 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.4-1.redhat_00003.1.el7sso | RHSA-2022:0448, RHSA-2022:0447 |
| RHEL 8.4 EUS | parfait +3 | 0.5.4-4.module+el8.4.0+13998+1b70e2b7 | RHSA-2022:0289 |
| RHEL 8.4 EUS | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.2 EUS | parfait +3 | 0.5.4-4.module+el8.2.0+13999+fa2fb353 | RHSA-2022:0291 |
| RHEL 8.2 EUS | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.1 E4S | parfait +3 | 0.5.4-4.module+el8.1.0+14000+df5fdac7 | RHSA-2022:0294 |
| RHEL 8.1 E4S | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 7.7 TUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.7 E4S | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.7 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 TUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 E4S | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.4 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.3 AUS | log4j +2 | 1.2.17-17.el7_3 | RHSA-2022:0442 |
| RHEL 6 ELS | log4j +2 | 1.2.14-6.6.el6_10 | RHSA-2022:0442 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.17-3.redhat_00008.1.ep6.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.23-26.redhat_26.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-46.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-49.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss EAP 7 | eap7-log4j | 2.17.1-1.redhat_00001.1.el7eap | RHSA-2022:1297, RHSA-2022:1296 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.el7eap | RHSA-2022:0436 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.24-2.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.24-1.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.45-2.Final_redhat_2.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.32-2.Final_redhat_1.2.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | log4j-eap6 | 1.2.17-3.redhat_00008.1.ep6.el6 | RHSA-2022:0438 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.4-3.Final_redhat_00002.1.ep6.el6 | RHSA-2022:0438 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | parfait +3 | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | si-units +1 | 0.6.5-2.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | unit-api +1 | 1.0-5.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-lib +1 | 1.0.1-6.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-parent | 1.0.3-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-se +1 | 1.0.4-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-systems +1 | 0.7-1.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | parfait | 0.5.4-4.module+el8.5.0+728+553fbdb8 | RLSA-2022:0290 |
| Rocky Linux 8 | si-units | 0.6.5-2.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | unit-api | 1.0-5.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-lib | 1.0.1-6.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-parent | 1.0.3-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-se | 1.0.4-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-systems | 0.7-1.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES 12 SP5 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
Show 26 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 12 SP3 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 12 SP2 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 11 SP4 | log4j | 1.2.15-26.32.20.1 | SUSE-SU-2022:14881-1 |
| SLES for SAP 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES for SAP 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES for SAP 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES for SAP 12 SP5 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES for SAP 12 SP4 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES for SAP 12 SP3 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLE Real Time 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLE HPC 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLE HPC 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLE HPC 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SUSE Package Hub 15 SP3 | kafka +1 | 2.1.0-bp153.2.6.1 | openSUSE-SU-2022:0038-1 |
| SUSE OpenStack Cloud Crowbar 9 | elasticsearch | 2.4.2-6.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | kafka | 0.10.2.2-3.5.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud Crowbar 9 | logstash | 2.4.1-7.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-agent | 2.8.2~dev5-3.18.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-persister-java | 1.12.1~dev9-15.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-thresh | 2.1.1-5.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | spark | 2.2.3-5.9.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | storm | 1.2.3-3.8.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | zookeeper | 3.4.13-3.12.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud Crowbar 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 9 | elasticsearch | 2.4.2-6.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | kafka | 0.10.2.2-3.5.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud 9 | logstash | 2.4.1-7.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-agent | 2.8.2~dev5-3.18.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-persister-java | 1.12.1~dev9-15.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-thresh | 2.1.1-5.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | spark | 2.2.3-5.9.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | storm | 1.2.3-3.8.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev23-3.36.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.31.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev17-4.31.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev7-3.34.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.39.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.35.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev164-6.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.28.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | zookeeper | 3.4.13-3.12.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.38.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev29-14.42.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.46.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev8-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev11-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev5-12.45.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev2-12.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev69-13.46.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev92-11.44.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.31.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.2~dev2-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE Manager Server 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Manager Retail Branch Server 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Manager Proxy 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | log4j | 1.2.15-26.32.20.1 | SUSE-SU-2022:14881-1 |
| SUSE HPE Helion OpenStack 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE HPE Helion OpenStack 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.38.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev29-14.42.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.46.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev8-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev11-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev5-12.45.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev2-12.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev69-13.46.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev92-11.44.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.31.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.2~dev2-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE Enterprise Storage 7 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Enterprise Storage 6 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kafka-kit | 2.1.0-3.1 | openSUSE-SU-2024:11838-1 |
| openSUSE Leap 15.3 | kafka +1 | 2.1.0-bp153.2.6.1 | openSUSE-SU-2022:0038-1 |
| openSUSE Leap 15.3 | log4j | 1.2.17-5.9.1 | openSUSE-SU-2022:0214-1 |
| openSUSE Leap 15.3 | log4j12 | 1.2.17-4.9.1 | openSUSE-SU-2022:0226-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j +2 | 1.2.17-18.amzn2 | ALAS2-2022-1750 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | parfait +3 | 0.5.4-4.module+el8.5.0+20480+407d1823 | ELSA-2022-0290 |
| Oracle Linux 8 | si-units +1 | 0.6.5-2.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | unit-api +1 | 1.0-5.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-lib +1 | 1.0.1-6.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-parent | 1.0.3-3.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-se +1 | 1.0.4-3.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-systems +1 | 0.7-1.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 7 | log4j +2 | 1.2.17-18.el7_4 | ELSA-2022-0442 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | log4j:log4j | <= 1.2.17 | — | GHSA-w9p3-5cr8-m3jj |
| Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | <= 2.0 | — | GHSA-w9p3-5cr8-m3jj |
Advisories 40
- ALSA-2022:0290 Important: parfait:0.5 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:5460 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:5459 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0524 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0448 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0475 Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1] Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0442 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0447 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0439 Red Hat Security Advisory: rh-maven36-log4j12 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0436 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0438 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0294 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0290 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0291 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0289 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-5998-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7590-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
- DLA-2905-1 apache-log4j1.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:0290 Important: parfait:0.5 security update Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2024:11838-1 kafka-kit-2.1.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0212-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0038-1 Security update for kafka SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0354-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, storm, storm-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:14881-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0521 Apache log4j: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2025
- SUSE-SU-2022:0355-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-log-metrics, openstack-monasca-log-persister, openstack-monasca-log-transformer, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
- WID-SEC-2024-3093 SAP Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2024
- ALAS2-2022-1750 Important: log4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 21, 2022
- ELSA-2022-0442 Important: log4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 8, 2022
- ELSA-2022-0290 Important: parfait:0.5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 27, 2022
References
- https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w
- https://logging.apache.org/log4j/1.2/index.html
- [oss-security] 20220118 CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220217-0006/
- https://www.oracle.com/security-alerts/cpujul2022.html