CVE-2022-23307 — A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Log4j 1.x	1.2.1 – < unspecified, unspecified – ≤ 2.0-alpha1	unspecified

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache-log4j1.2	1.2.17-11	—
Debian 13	apache-log4j1.2	1.2.17-11	—
Debian 12	apache-log4j1.2	1.2.17-11	—
Debian 9	apache-log4j1.2	1.2.17-7+deb9u2	DLA-2905-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	apache-log4j1.2	1.2.17-9ubuntu0.2	USN-5998-1
Ubuntu 18.04 LTS	apache-log4j1.2	1.2.17-8+deb10u1ubuntu0.2	USN-5998-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	apache-log4j1.2	1.2.17-7ubuntu1+esm1	USN-5998-1
Ubuntu Pro 14.04 LTS	apache-log4j1.2	1.2.17-4ubuntu3+esm2	USN-7590-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	parfait +3	0.5.4-4.module+el8.5.0+13988+de2b8c0b	RHSA-2022:0290
RHEL 8	si-units +1	0.6.5-2.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 8	unit-api +1	1.0-5.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 8	uom-lib +1	1.0.1-6.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 8	uom-parent	1.0.3-3.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 8	uom-se +1	1.0.4-3.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 8	uom-systems +1	0.7-1.module+el8+2463+615f6896	RHSA-2022:0290
RHEL 7	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 3	rh-maven36-log4j12 +1	1.2.17-23.4.el7	RHSA-2022:0439

Show 18 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhev Manager 4	rhvm +19	4.4.10.6-0.1.el8ev	RHSA-2022:0475
Red Hat Rhev Manager 4	snmp4j +1	3.6.4-0.1.el8ev	RHSA-2022:0475
Red Hat Single Sign On 7	rh-sso7-keycloak +1	15.0.4-1.redhat_00003.1.el7sso	RHSA-2022:0448, RHSA-2022:0447
RHEL 8.4 EUS	parfait +3	0.5.4-4.module+el8.4.0+13998+1b70e2b7	RHSA-2022:0289
RHEL 8.4 EUS	si-units +1	0.6.5-2.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.4 EUS	unit-api +1	1.0-5.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.4 EUS	uom-lib +1	1.0.1-6.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.4 EUS	uom-parent	1.0.3-3.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.4 EUS	uom-se +1	1.0.4-3.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.4 EUS	uom-systems +1	0.7-1.module+el8+2463+615f6896	RHSA-2022:0289
RHEL 8.2 EUS	parfait +3	0.5.4-4.module+el8.2.0+13999+fa2fb353	RHSA-2022:0291
RHEL 8.2 EUS	si-units +1	0.6.5-2.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.2 EUS	unit-api +1	1.0-5.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.2 EUS	uom-lib +1	1.0.1-6.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.2 EUS	uom-parent	1.0.3-3.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.2 EUS	uom-se +1	1.0.4-3.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.2 EUS	uom-systems +1	0.7-1.module+el8+2463+615f6896	RHSA-2022:0291
RHEL 8.1 E4S	parfait +3	0.5.4-4.module+el8.1.0+14000+df5fdac7	RHSA-2022:0294
RHEL 8.1 E4S	si-units +1	0.6.5-2.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 8.1 E4S	unit-api +1	1.0-5.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 8.1 E4S	uom-lib +1	1.0.1-6.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 8.1 E4S	uom-parent	1.0.3-3.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 8.1 E4S	uom-se +1	1.0.4-3.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 8.1 E4S	uom-systems +1	0.7-1.module+el8+2463+615f6896	RHSA-2022:0294
RHEL 7.7 TUS	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.7 E4S	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.7 AUS	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.6 TUS	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.6 E4S	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.6 AUS	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.4 AUS	log4j +2	1.2.17-18.el7_4	RHSA-2022:0442
RHEL 7.3 AUS	log4j +2	1.2.17-17.el7_3	RHSA-2022:0442
RHEL 6 ELS	log4j +2	1.2.14-6.6.el6_10	RHSA-2022:0442
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-apache-commons-beanutils	1.9.4-1.redhat_00002.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-apache-cxf +3	3.4.10-1.SP1_redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-avro	1.7.6-8.redhat_00003.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-h2database	1.4.197-3.redhat_00004.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-infinispan +5	8.2.11-1.SP2_redhat_00001.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-databind	2.8.11.5-1.redhat_00001.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-annotations-api_1.3_spec	2.0.1-4.Final_redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-marshalling +1	2.0.15-1.Final_redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-server-migration +21	1.7.2-12.Final_redhat_00013.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-xnio-base	3.7.13-1.Final_redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-log4j-jboss-logmanager	1.2.2-1.Final_redhat_00002.1.ep7.el7	RHSA-2024:10207, RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-netty +1	4.1.45-1.Final_redhat_00001.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-12.SP12_redhat_00001.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.7-2.GA_redhat_00002.1.ep7.el7	RHSA-2024:10207, RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron	1.1.13-1.Final_redhat_00001.1.ep7.el7	RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-javadocs +2	7.3.11-4.GA_redhat_00002.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wss4j +6	2.3.3-2.redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-xalan-j2	2.7.1-38.redhat_00015.1.el7eap	RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-xml-security	2.2.3-2.redhat_00001.1.el7eap	RHSA-2024:10207
Red Hat JBoss Web Server 3	log4j-eap6	1.2.17-3.redhat_00008.1.ep6.el7	RHSA-2022:0524
Red Hat JBoss Web Server 3	tomcat-native	1.2.23-26.redhat_26.ep7.el7	RHSA-2022:0524
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-46.ep7.el7	RHSA-2022:0524
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-49.ep7.el7	RHSA-2022:0524
Red Hat JBoss EAP 7	eap7-log4j	2.17.1-1.redhat_00001.1.el7eap	RHSA-2022:1297, RHSA-2022:1296
Red Hat JBoss EAP 7	eap7-log4j-jboss-logmanager	1.2.2-1.Final_redhat_00002.1.el7eap	RHSA-2022:0436
Red Hat JBoss EAP 6	jboss-as-ee +61	7.5.24-2.Final_redhat_00001.1.ep6.el6	RHSA-2022:5460, RHSA-2022:5459
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.24-1.Final_redhat_00001.1.ep6.el6	RHSA-2022:5460, RHSA-2022:5459
Red Hat JBoss EAP 6	jbossts	1:4.17.45-2.Final_redhat_2.1.ep6.el6	RHSA-2022:5460, RHSA-2022:5459
Red Hat JBoss EAP 6	jbossweb	7.5.32-2.Final_redhat_1.2.ep6.el6	RHSA-2022:5460, RHSA-2022:5459
Red Hat JBoss EAP 6	log4j-eap6	1.2.17-3.redhat_00008.1.ep6.el6	RHSA-2022:0438
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.1.4-3.Final_redhat_00002.1.ep6.el6	RHSA-2022:0438

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	parfait +3	0.5.4-4.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	si-units +1	0.6.5-2.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	unit-api +1	1.0-5.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	uom-lib +1	1.0.1-6.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	uom-parent	1.0.3-3.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	uom-se +1	1.0.4-3.module_el8.5.0+235+62ea7738	ALSA-2022:0290
AlmaLinux 8	uom-systems +1	0.7-1.module_el8.5.0+235+62ea7738	ALSA-2022:0290

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	parfait	0.5.4-4.module+el8.5.0+728+553fbdb8	RLSA-2022:0290
Rocky Linux 8	si-units	0.6.5-2.module+el8.3.0+214+edf13b3f	RLSA-2022:0290
Rocky Linux 8	unit-api	1.0-5.module+el8.3.0+214+edf13b3f	RLSA-2022:0290
Rocky Linux 8	uom-lib	1.0.1-6.module+el8.3.0+214+edf13b3f	RLSA-2022:0290
Rocky Linux 8	uom-parent	1.0.3-3.module+el8.3.0+214+edf13b3f	RLSA-2022:0290
Rocky Linux 8	uom-se	1.0.4-3.module+el8.3.0+214+edf13b3f	RLSA-2022:0290
Rocky Linux 8	uom-systems	0.7-1.module+el8.3.0+214+edf13b3f	RLSA-2022:0290

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP3	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SLES 15 SP2	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SLES 15 SP1	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SLES 15	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SLES 12 SP5	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1

Show 26 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP4	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLES 12 SP3	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLES 12 SP2	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLES 11 SP4	log4j	1.2.15-26.32.20.1	SUSE-SU-2022:14881-1
SLES for SAP 15 SP2	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SLES for SAP 15 SP1	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SLES for SAP 15	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SLES for SAP 12 SP5	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLES for SAP 12 SP4	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLES for SAP 12 SP3	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SLE Real Time 15 SP2	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SLE HPC 15 SP2	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SLE HPC 15 SP1	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SLE HPC 15	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1
SUSE Package Hub 15 SP3	kafka +1	2.1.0-bp153.2.6.1	openSUSE-SU-2022:0038-1
SUSE OpenStack Cloud Crowbar 9	elasticsearch	2.4.2-6.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	kafka	0.10.2.2-3.5.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SUSE OpenStack Cloud Crowbar 9	logstash	2.4.1-7.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	openstack-monasca-agent	2.8.2~dev5-3.18.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	openstack-monasca-persister-java	1.12.1~dev9-15.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	openstack-monasca-thresh	2.1.1-5.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	spark	2.2.3-5.9.2	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	storm	1.2.3-3.8.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 9	zookeeper	3.4.13-3.12.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud Crowbar 8	elasticsearch	2.4.2-5.6.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	kafka	0.10.2.2-5.12.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SUSE OpenStack Cloud Crowbar 8	logstash	2.4.1-5.10.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-agent	2.2.6~dev4-3.27.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-log-metrics	0.0.1-3.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-log-persister	0.0.1-5.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-log-transformer	0.0.1-4.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-persister-java	1.7.1~a0~dev2-3.9.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-thresh	2.1.1-4.6.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	spark	1.6.3-8.12.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	storm	1.2.3-3.11.2	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud Crowbar 8	zookeeper	3.4.10-3.15.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 9	elasticsearch	2.4.2-6.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	kafka	0.10.2.2-3.5.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SUSE OpenStack Cloud 9	logstash	2.4.1-7.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	openstack-monasca-agent	2.8.2~dev5-3.18.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	openstack-monasca-persister-java	1.12.1~dev9-15.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	openstack-monasca-thresh	2.1.1-5.6.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	spark	2.2.3-5.9.2	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	storm	1.2.3-3.8.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-barbican	7.0.1~dev24-3.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-cinder	13.0.10~dev23-3.36.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-designate	7.0.2~dev2-3.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-glance	17.0.1~dev30-3.31.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-heat	11.0.4~dev4-3.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-horizon	14.1.1~dev11-4.37.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-ironic	11.1.5~dev17-4.31.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-keystone	14.2.1~dev7-3.34.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-magnum	7.2.1~dev1-4.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-manila	7.4.2~dev60-3.39.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-monasca	2.7.1~dev10-3.35.2	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-monasca-ceilometer	1.8.2~dev3-3.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-neutron	13.0.8~dev164-6.37.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-nova	18.3.1~dev91-3.37.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-octavia	3.2.3~dev7-4.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-sahara	9.0.2~dev15-3.33.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	venv-openstack-swift	2.19.2~dev48-2.28.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 9	zookeeper	3.4.13-3.12.1	SUSE-SU-2022:0354-1
SUSE OpenStack Cloud 8	elasticsearch	2.4.2-5.6.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	kafka	0.10.2.2-5.12.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SUSE OpenStack Cloud 8	logstash	2.4.1-5.10.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-agent	2.2.6~dev4-3.27.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-log-metrics	0.0.1-3.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-log-persister	0.0.1-5.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-log-transformer	0.0.1-4.3.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-persister-java	1.7.1~a0~dev2-3.9.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	openstack-monasca-thresh	2.1.1-4.6.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	spark	1.6.3-8.12.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	storm	1.2.3-3.11.2	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-aodh	5.1.1~dev7-12.40.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-barbican	5.0.2~dev3-12.41.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-ceilometer	9.0.8~dev7-12.38.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-cinder	11.2.3~dev29-14.42.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-designate	5.0.3~dev7-12.39.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.36.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-glance	15.0.3~dev3-12.39.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.43.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-horizon	12.0.5~dev6-14.46.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-ironic	9.1.8~dev8-12.41.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-keystone	12.0.4~dev11-11.43.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.40.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-manila	5.1.1~dev5-12.45.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-monasca	2.2.2~dev1-11.43.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.36.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev2-12.36.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-neutron	11.0.9~dev69-13.46.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-nova	16.1.9~dev92-11.44.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-octavia	1.0.6~dev3-12.41.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-sahara	7.0.5~dev4-11.40.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.31.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	venv-openstack-trove	8.0.2~dev2-11.40.1	SUSE-SU-2022:0355-1
SUSE OpenStack Cloud 8	zookeeper	3.4.10-3.15.1	SUSE-SU-2022:0355-1
SUSE Manager Server 4.1	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SUSE Manager Retail Branch Server 4.1	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SUSE Manager Proxy 4.1	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SUSE Linux Enterprise Point of Sale 11 SP3	log4j	1.2.15-26.32.20.1	SUSE-SU-2022:14881-1
SUSE HPE Helion OpenStack 8	elasticsearch	2.4.2-5.6.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	kafka	0.10.2.2-5.12.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	log4j	1.2.15-126.9.1	SUSE-SU-2022:0212-1
SUSE HPE Helion OpenStack 8	logstash	2.4.1-5.10.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-agent	2.2.6~dev4-3.27.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-log-metrics	0.0.1-3.3.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-log-persister	0.0.1-5.3.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-log-transformer	0.0.1-4.3.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-persister-java	1.7.1~a0~dev2-3.9.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	openstack-monasca-thresh	2.1.1-4.6.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	spark	1.6.3-8.12.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	storm	1.2.3-3.11.2	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-aodh	5.1.1~dev7-12.40.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-barbican	5.0.2~dev3-12.41.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-ceilometer	9.0.8~dev7-12.38.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-cinder	11.2.3~dev29-14.42.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-designate	5.0.3~dev7-12.39.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.36.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-glance	15.0.3~dev3-12.39.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.43.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-horizon-hpe	12.0.5~dev6-14.46.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-ironic	9.1.8~dev8-12.41.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-keystone	12.0.4~dev11-11.43.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.40.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-manila	5.1.1~dev5-12.45.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca	2.2.2~dev1-11.43.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.36.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev2-12.36.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-neutron	11.0.9~dev69-13.46.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-nova	16.1.9~dev92-11.44.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-octavia	1.0.6~dev3-12.41.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-sahara	7.0.5~dev4-11.40.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.31.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	venv-openstack-trove	8.0.2~dev2-11.40.1	SUSE-SU-2022:0355-1
SUSE HPE Helion OpenStack 8	zookeeper	3.4.10-3.15.1	SUSE-SU-2022:0355-1
SUSE Enterprise Storage 7	log4j12	1.2.17-4.9.1	SUSE-SU-2022:0226-1
SUSE Enterprise Storage 6	log4j	1.2.17-5.9.1	SUSE-SU-2022:0214-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	kafka-kit	2.1.0-3.1	openSUSE-SU-2024:11838-1
openSUSE Leap 15.3	kafka +1	2.1.0-bp153.2.6.1	openSUSE-SU-2022:0038-1
openSUSE Leap 15.3	log4j	1.2.17-5.9.1	openSUSE-SU-2022:0214-1
openSUSE Leap 15.3	log4j12	1.2.17-4.9.1	openSUSE-SU-2022:0226-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	log4j +2	1.2.17-18.amzn2	ALAS2-2022-1750

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	parfait +3	0.5.4-4.module+el8.5.0+20480+407d1823	ELSA-2022-0290
Oracle Linux 8	si-units +1	0.6.5-2.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 8	unit-api +1	1.0-5.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 8	uom-lib +1	1.0.1-6.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 8	uom-parent	1.0.3-3.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 8	uom-se +1	1.0.4-3.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 8	uom-systems +1	0.7-1.module+el8+5163+abb6ece5	ELSA-2022-0290
Oracle Linux 7	log4j +2	1.2.17-18.el7_4	ELSA-2022-0442

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	druid	35.0.1-r1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	log4j:log4j	<= 1.2.17	—	GHSA-f7vh-qwp3-x37m
Maven	org.zenframework.z8.dependencies.commons:log4j-1.2.17	<= 2.0	—	GHSA-f7vh-qwp3-x37m

Advisories 40

ALSA-2022:0290 Important: parfait:0.5 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5460 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5459 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0524 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0448 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0475 Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1] Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0442 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0447 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0439 Red Hat Security Advisory: rh-maven36-log4j12 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0436 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0438 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0294 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0290 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0291 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:0289 Red Hat Security Advisory: parfait:0.5 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-5998-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-7590-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
DLA-2905-1 apache-log4j1.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:0290 Important: parfait:0.5 security update Rocky Linux Security Advisories · Feb 5, 2026
openSUSE-SU-2024:11838-1 kafka-kit-2.1.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0212-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0226-1 Security update for log4j12 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2022:0038-1 Security update for kafka SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0354-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, storm, storm-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:14881-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0214-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-0521 Apache log4j: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2025
SUSE-SU-2022:0355-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-log-metrics, openstack-monasca-log-persister, openstack-monasca-log-transformer, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, venv-openstack-monasca, zookeeper, zookeeper-kit SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
ALAS2-2022-1750 Important: log4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 21, 2022
ELSA-2022-0442 Important: log4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 8, 2022
ELSA-2022-0290 Important: parfait:0.5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 27, 2022

EUVD	v3.1	8.8
OSV:GHSA	v3.1	9.8
CISA-ADP	v3.1	8.8

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Oracle Linux

Wolfi

Affected packages

Advisories 40

References