VDB
RHSA-2022%3A0181
RHSA-2022%3A0181
PUBLISHED
CVSS 6.599999904632568 MEDIUM
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Risk Scores
CVSS 3.1
6.599999904632568
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-node-feature-discovery@sha256:bd3a05f7433b159efc5dd4aa12afffa6e9121ae612a93722425ddcef6fbaf9d3_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-node-feature-discovery@sha256:bd3a05f7433b159efc5dd4aa12afffa6e9121ae612a93722425ddcef6fbaf9d3_ppc64le |
| Red Hat | openshift4/ose-cluster-capacity@sha256:914377c29c441b67235d5da849da9d5d2ca0c206eff6092f81cba427359a6a68_s390x as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-cluster-capacity@sha256:914377c29c441b67235d5da849da9d5d2ca0c206eff6092f81cba427359a6a68_s390x |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:b10e9335ffcb0c66cc733c493e7e90c81ecdc62fe74cb628260553141dd0e768_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-cluster-kube-descheduler-operator@sha256:b10e9335ffcb0c66cc733c493e7e90c81ecdc62fe74cb628260553141dd0e768_ppc64le |
| Red Hat | openshift4/ose-logging-curator5@sha256:f291f5cf001e32843171cced32c9266b3801cf8838d44fd150f7064c8edd15bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-logging-curator5@sha256:f291f5cf001e32843171cced32c9266b3801cf8838d44fd150f7064c8edd15bc_ppc64le |
| Red Hat | openshift4/ose-cluster-nfd-operator@sha256:837499b03eb6d86f40c9376d7f58ca99736fb028b9171215c9c11b3b7c9e1ea5_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-cluster-nfd-operator@sha256:837499b03eb6d86f40c9376d7f58ca99736fb028b9171215c9c11b3b7c9e1ea5_ppc64le |
| Red Hat | openshift4/ose-sriov-network-operator@sha256:49d76edf3ab80e9be59a94ec660d8168812f3455f5f10ff71826bb96969ffcec_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-sriov-network-operator@sha256:49d76edf3ab80e9be59a94ec660d8168812f3455f5f10ff71826bb96969ffcec_amd64 |
| Red Hat | openshift4/ose-sriov-network-operator@sha256:185cba65f61575ba943dd5cb2726a0ac9f46a2f7a70d215f20b5364236c9670d_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-sriov-network-operator@sha256:185cba65f61575ba943dd5cb2726a0ac9f46a2f7a70d215f20b5364236c9670d_ppc64le |
| Red Hat | openshift4/ose-logging-curator5@sha256:ef9ca522e2e42d28263fe567dfd1455872a13b779d009f569f86a9806f7727b5_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-logging-curator5@sha256:ef9ca522e2e42d28263fe567dfd1455872a13b779d009f569f86a9806f7727b5_amd64 |
| Red Hat | openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:3089ef3143857097229cf2b1098125c3bd889d920cbcd1e90e93870a4536a315_s390x as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:3089ef3143857097229cf2b1098125c3bd889d920cbcd1e90e93870a4536a315_s390x |
| Red Hat | openshift4/ose-sriov-network-config-daemon@sha256:a81cd86608af1bf295b247df68549ca62a980d6063f87fe6855f52ef69f9d933_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | * |
| Red Hat | openshift4/ose-logging-fluentd@sha256:a8cfdeddcc6a910f5cb320afa136544575c6c8a957270973ce0fd09c090cada6_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-logging-fluentd@sha256:a8cfdeddcc6a910f5cb320afa136544575c6c8a957270973ce0fd09c090cada6_amd64 |
| Red Hat | openshift4/ose-sriov-infiniband-cni@sha256:bd3f71cebd3399a0c610439ef26582deb6e67ca46080fe8e6c3e2b51bb95d118_s390x as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-sriov-infiniband-cni@sha256:bd3f71cebd3399a0c610439ef26582deb6e67ca46080fe8e6c3e2b51bb95d118_s390x |
| Red Hat | openshift4/ose-ansible-operator@sha256:9851086ac084c5187482604b55b216009af51174b51b0a4ecaa22ae6965bdfac_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-ansible-operator@sha256:9851086ac084c5187482604b55b216009af51174b51b0a4ecaa22ae6965bdfac_ppc64le |
| Red Hat | openshift4/ose-node-feature-discovery@sha256:949915f8d3fa7b0d99e8b01fdf6cc6a28c16942a6978fa7cbb604467a5b9bd04_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-node-feature-discovery@sha256:949915f8d3fa7b0d99e8b01fdf6cc6a28c16942a6978fa7cbb604467a5b9bd04_amd64 |
| Red Hat | openshift4/ose-egress-dns-proxy@sha256:12b125762c840f8f556b5338f26543c56358cb2a4e0da718f28c537c17978e92_s390x as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-egress-dns-proxy@sha256:12b125762c840f8f556b5338f26543c56358cb2a4e0da718f28c537c17978e92_s390x |
| Red Hat | openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:3487912c66a6b61677be483ad0d48d404933d4f2c855a962b0038adefda820ac_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:3487912c66a6b61677be483ad0d48d404933d4f2c855a962b0038adefda820ac_amd64 |
| Red Hat | openshift4/ose-egress-http-proxy@sha256:1995f9ac67fec2ed8872a89fe7bf7bb72d9a25d50dc3f6060ae6cb7ca0b1cc50_ppc64le as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-egress-http-proxy@sha256:1995f9ac67fec2ed8872a89fe7bf7bb72d9a25d50dc3f6060ae6cb7ca0b1cc50_ppc64le |
| Red Hat | openshift4/ose-jenkins-agent-nodejs-10-rhel8@sha256:18b19dd12254c5ce801ca4876c517a804dc1135104aada08822b8a1a01dea88b_s390x as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-jenkins-agent-nodejs-10-rhel8@sha256:18b19dd12254c5ce801ca4876c517a804dc1135104aada08822b8a1a01dea88b_s390x |
| Red Hat | openshift4/ose-egress-http-proxy@sha256:989062e17028afc452b6049eeb2b49988dbca1857b5be4c0ebc0d540ef4a9f0c_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-egress-http-proxy@sha256:989062e17028afc452b6049eeb2b49988dbca1857b5be4c0ebc0d540ef4a9f0c_amd64 |
| Red Hat | openshift4/ose-metering-reporting-operator@sha256:677d94835e2141a208294a4c241c8ed214a6d9c5c21c03c88c7ccf19b461d3b5_amd64 as a component of Red Hat OpenShift Container Platform 4.6 | openshift4/ose-metering-reporting-operator@sha256:677d94835e2141a208294a4c241c8ed214a6d9c5c21c03c88c7ccf19b461d3b5_amd64 |
…and 106 more
Timeline
- Jan 27, 2022 CVE Published
- Mar 19, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:0181 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1985826 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2034412 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2035951 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0181.json advisory
- https://access.redhat.com/security/cve/CVE-2021-44832 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44832 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-44832 advisory
- https://issues.apache.org/jira/browse/LOG4J2-3293 advisory