Description
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j 1.x | 1.2.1 – < unspecified, unspecified – < 2.0-alpha1 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 13 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 12 | apache-log4j1.2 | 1.2.17-11 | — |
| Debian 9 | apache-log4j1.2 | 1.2.17-7+deb9u2 | DLA-2905-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j1.2 | 1.2.17-9ubuntu0.2 | USN-5998-1 |
| Ubuntu 18.04 LTS | apache-log4j1.2 | 1.2.17-8+deb10u1ubuntu0.2 | USN-5998-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j1.2 | 1.2.17-7ubuntu1+esm1 | USN-5998-1 |
| Ubuntu Pro 14.04 LTS | apache-log4j1.2 | 1.2.17-4ubuntu3+esm2 | USN-7590-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | parfait +3 | 0.5.4-4.module+el8.5.0+13988+de2b8c0b | RHSA-2022:0290 |
| RHEL 8 | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 8 | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0290 |
| RHEL 7 | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 3 | rh-maven36-log4j12 +1 | 1.2.17-23.4.el7 | RHSA-2022:0439 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.10.6-0.1.el8ev | RHSA-2022:0475 |
| Red Hat Rhev Manager 4 | snmp4j +1 | 3.6.4-0.1.el8ev | RHSA-2022:0475 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.4-1.redhat_00003.1.el7sso | RHSA-2022:0448, RHSA-2022:0447 |
| RHEL 8.4 EUS | parfait +3 | 0.5.4-4.module+el8.4.0+13998+1b70e2b7 | RHSA-2022:0289 |
| RHEL 8.4 EUS | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.4 EUS | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0289 |
| RHEL 8.2 EUS | parfait +3 | 0.5.4-4.module+el8.2.0+13999+fa2fb353 | RHSA-2022:0291 |
| RHEL 8.2 EUS | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.2 EUS | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0291 |
| RHEL 8.1 E4S | parfait +3 | 0.5.4-4.module+el8.1.0+14000+df5fdac7 | RHSA-2022:0294 |
| RHEL 8.1 E4S | si-units +1 | 0.6.5-2.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | unit-api +1 | 1.0-5.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-lib +1 | 1.0.1-6.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-parent | 1.0.3-3.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-se +1 | 1.0.4-3.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 8.1 E4S | uom-systems +1 | 0.7-1.module+el8+2463+615f6896 | RHSA-2022:0294 |
| RHEL 7.7 TUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.7 E4S | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.7 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 TUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 E4S | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.6 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.4 AUS | log4j +2 | 1.2.17-18.el7_4 | RHSA-2022:0442 |
| RHEL 7.3 AUS | log4j +2 | 1.2.17-17.el7_3 | RHSA-2022:0442 |
| RHEL 6 ELS | log4j +2 | 1.2.14-6.6.el6_10 | RHSA-2022:0442 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.4.10-1.SP1_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-8.redhat_00003.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-3.redhat_00004.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.7.13-1.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:10207, RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10207, RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-38.redhat_00015.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.2.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.17-3.redhat_00008.1.ep6.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.23-26.redhat_26.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-46.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-49.ep7.el7 | RHSA-2022:0524 |
| Red Hat JBoss EAP 7 | eap7-log4j | 2.17.1-1.redhat_00001.1.el7eap | RHSA-2022:1297, RHSA-2022:1296 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.el7eap | RHSA-2022:0436 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.24-2.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.24-1.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.45-2.Final_redhat_2.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.32-2.Final_redhat_1.2.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | log4j-eap6 | 1.2.17-3.redhat_00008.1.ep6.el6 | RHSA-2022:0438 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.4-3.Final_redhat_00002.1.ep6.el6 | RHSA-2022:0438 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | parfait +3 | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | si-units +1 | 0.6.5-2.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | unit-api +1 | 1.0-5.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-lib +1 | 1.0.1-6.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-parent | 1.0.3-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-se +1 | 1.0.4-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux 8 | uom-systems +1 | 0.7-1.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | parfait | 0.5.4-4.module+el8.5.0+728+553fbdb8 | RLSA-2022:0290 |
| Rocky Linux 8 | si-units | 0.6.5-2.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | unit-api | 1.0-5.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-lib | 1.0.1-6.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-parent | 1.0.3-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-se | 1.0.4-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux 8 | uom-systems | 0.7-1.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES 12 SP5 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
Show 26 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 12 SP3 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 12 SP2 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES 11 SP4 | log4j | 1.2.15-26.32.20.1 | SUSE-SU-2022:14881-1 |
| SLES for SAP 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLES for SAP 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES for SAP 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLES for SAP 12 SP5 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES for SAP 12 SP4 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLES for SAP 12 SP3 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SLE Real Time 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLE HPC 15 SP2 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SLE HPC 15 SP1 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SLE HPC 15 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
| SUSE Package Hub 15 SP3 | kafka +1 | 2.1.0-bp153.2.6.1 | openSUSE-SU-2022:0038-1 |
| SUSE OpenStack Cloud Crowbar 9 | elasticsearch | 2.4.2-6.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | kafka | 0.10.2.2-3.5.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud Crowbar 9 | logstash | 2.4.1-7.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-agent | 2.8.2~dev5-3.18.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-persister-java | 1.12.1~dev9-15.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-monasca-thresh | 2.1.1-5.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | spark | 2.2.3-5.9.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | storm | 1.2.3-3.8.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 9 | zookeeper | 3.4.13-3.12.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud Crowbar 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud Crowbar 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud Crowbar 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 9 | elasticsearch | 2.4.2-6.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | kafka | 0.10.2.2-3.5.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud 9 | logstash | 2.4.1-7.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-agent | 2.8.2~dev5-3.18.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-persister-java | 1.12.1~dev9-15.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | openstack-monasca-thresh | 2.1.1-5.6.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | spark | 2.2.3-5.9.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | storm | 1.2.3-3.8.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev23-3.36.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.31.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev17-4.31.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev7-3.34.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.39.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.35.2 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev164-6.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.37.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.33.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.28.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 9 | zookeeper | 3.4.13-3.12.1 | SUSE-SU-2022:0354-1 |
| SUSE OpenStack Cloud 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE OpenStack Cloud 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.38.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev29-14.42.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.46.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev8-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev11-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev5-12.45.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev2-12.36.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev69-13.46.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev92-11.44.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.31.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.2~dev2-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE OpenStack Cloud 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE Manager Server 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Manager Retail Branch Server 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Manager Proxy 4.1 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | log4j | 1.2.15-26.32.20.1 | SUSE-SU-2022:14881-1 |
| SUSE HPE Helion OpenStack 8 | elasticsearch | 2.4.2-5.6.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | kafka | 0.10.2.2-5.12.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | log4j | 1.2.15-126.9.1 | SUSE-SU-2022:0212-1 |
| SUSE HPE Helion OpenStack 8 | logstash | 2.4.1-5.10.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-agent | 2.2.6~dev4-3.27.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-metrics | 0.0.1-3.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-persister | 0.0.1-5.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-log-transformer | 0.0.1-4.3.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-persister-java | 1.7.1~a0~dev2-3.9.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-thresh | 2.1.1-4.6.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | spark | 1.6.3-8.12.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | storm | 1.2.3-3.11.2 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.38.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev29-14.42.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.39.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.46.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev8-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev11-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev5-12.45.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.43.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev2-12.36.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev69-13.46.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev92-11.44.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.41.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.31.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.2~dev2-11.40.1 | SUSE-SU-2022:0355-1 |
| SUSE HPE Helion OpenStack 8 | zookeeper | 3.4.10-3.15.1 | SUSE-SU-2022:0355-1 |
| SUSE Enterprise Storage 7 | log4j12 | 1.2.17-4.9.1 | SUSE-SU-2022:0226-1 |
| SUSE Enterprise Storage 6 | log4j | 1.2.17-5.9.1 | SUSE-SU-2022:0214-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | kafka +1 | 2.1.0-bp153.2.6.1 | openSUSE-SU-2022:0038-1 |
| openSUSE Leap 15.3 | log4j | 1.2.17-5.9.1 | openSUSE-SU-2022:0214-1 |
| openSUSE Leap 15.3 | log4j12 | 1.2.17-4.9.1 | openSUSE-SU-2022:0226-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j +2 | 1.2.17-18.amzn2 | ALAS2-2022-1750 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | parfait +3 | 0.5.4-4.module+el8.5.0+20480+407d1823 | ELSA-2022-0290 |
| Oracle Linux 8 | si-units +1 | 0.6.5-2.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | unit-api +1 | 1.0-5.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-lib +1 | 1.0.1-6.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-parent | 1.0.3-3.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-se +1 | 1.0.4-3.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 8 | uom-systems +1 | 0.7-1.module+el8+5163+abb6ece5 | ELSA-2022-0290 |
| Oracle Linux 7 | log4j +2 | 1.2.17-18.el7_4 | ELSA-2022-0442 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 4 repositories
-
HynekPetrak/log4shell-finder ★ 39 · Dec 14, 2021
Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excelle…
-
AlphabugX/CVE-2022-RCE ★ 5 · Jan 21, 2022
test 反向辣鸡数据投放 CVE-2022-23305 工具 利用 教程 Exploit POC
-
tkomlodi/CVE-2022-23305_POC ★ 1 · Jul 24, 2023
CVE-2022-23305 Log4J JDBCAppender SQl injection POC
-
hoor113/CVE-2022-23305-Demo-and-Whitebox-Report ★ 0 · Oct 17, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | log4j:log4j | <= 1.2.17 | — | GHSA-65fg-84f6-3jq3 |
| Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | <= 2.0 | — | GHSA-65fg-84f6-3jq3 |
Advisories 47
- ALSA-2022:0290 Important: parfait:0.5 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:5460 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:5459 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0524 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0448 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0475 Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1] Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0447 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0442 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0439 Red Hat Security Advisory: rh-maven36-log4j12 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0436 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0438 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0294 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0290 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0291 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0289 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-2893 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-5998-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7590-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
- DLA-2905-1 apache-log4j1.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:0290 Important: parfait:0.5 security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2022:0212-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0038-1 Security update for kafka SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0354-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, storm, storm-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:14881-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0169 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2022-0521 Apache log4j: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2025
- SUSE-SU-2022:0355-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-log-metrics, openstack-monasca-log-persister, openstack-monasca-log-transformer, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
- NCSC-2024-0418 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2023-1809 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-1027 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2022-1769 Oracle E-Business Suite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2023
- ALAS2-2022-1750 Important: log4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 21, 2022
- ELSA-2022-0442 Important: log4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 8, 2022
- ELSA-2022-0290 Important: parfait:0.5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 27, 2022
References
- https://logging.apache.org/log4j/1.2/index.html
- https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y
- [oss-security] 20220118 CVE-2022-23305: SQL injection in JDBC Appender in Apache Log4j V1 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220217-0007/
- https://www.oracle.com/security-alerts/cpujul2022.html