Skip to content
OpenAdvisories
High · 7.5 CVE-2023-26464 EUVD-2023-1115GHSA-vp98-w2p3-mv35

Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

Published Mar 10, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Log4j Package: apache-log4j1.2 Package: druid Package: log4j:log4j Package: org.apache.logging.log4j:log4j-core Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

** UNSUPPORTED WHEN ASSIGNED **

When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested)
hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.

This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Log4j 1.0.4 – < 2 2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS apache-log4j1.2 No fix yet —
Ubuntu 18.04 LTS apache-log4j1.2 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS apache-log4j1.2 No fix yet —
Ubuntu Pro 14.04 LTS apache-log4j1.2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ocp Tools 4 jenkins 2.401.1.1686831596-3.el8 RHSA-2023:3663
Red Hat Ocp Tools 4 jenkins-2-plugins 4.11.1686831822-1.el8 RHSA-2023:3663
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.1.16-3.SP1_redhat_00001.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-bouncycastle +3 1.68.0-1.redhat_00005.1.ep7.el7 RHSA-2024:10208
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 RHSA-2024:10208
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-annotations-api_1.3_spec 2.0.1-4.Final_redhat_00001.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-marshalling +1 2.0.15-1.Final_redhat_00001.1.el7eap RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-12.Final_redhat_00013.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-xnio-base 3.5.10-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-log4j-jboss-logmanager 1.2.2-2.Final_redhat_00002.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.8-2.GA_redhat_00002.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.11-4.GA_redhat_00002.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wss4j +6 2.3.3-2.redhat_00001.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-xml-security 2.2.3-2.redhat_00001.1.el7eap RHSA-2024:10207
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.16.0-15.redhat_00049.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.76.0-4.redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-hal-console 3.3.19-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.31-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.15-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.13-2.SP1_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-modules 1.12.2-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-31.Final_redhat_00030.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.10-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-mod_cluster 1.4.5-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-netty +28 4.1.94-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-resteasy +18 3.15.8-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.13-8.GA_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.20-1.Final_redhat_00001.1.el7eap RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.13-8.GA_redhat_00001.1.el8eap RHSA-2023:5486, RHSA-2023:5485

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling druid No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven log4j:log4j >= 1.0.4, < 2.0 2.0 GHSA-vp98-w2p3-mv35
Maven org.apache.logging.log4j:log4j-core >= 1.0.4, < 2.0 2.0 GHSA-vp98-w2p3-mv35

Advisories 11

References