VDB

RHSA-2022%3A0225

RHSA-2022%3A0225 PUBLISHED CVSS 6.599999904632568 MEDIUM

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Risk Scores

CVSS 3.1
6.599999904632568
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatopenshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le as a component of OpenShift Logging 5.0openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le
Red Hatopenshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64 as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64
Red Hatopenshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x as a component of OpenShift Logging 5.0openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x
Red Hatopenshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le as a component of OpenShift Logging 5.0*
Red Hatopenshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x as a component of OpenShift Logging 5.0openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x
Red Hatopenshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le as a component of OpenShift Logging 5.0openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le
Red Hatopenshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64 as a component of OpenShift Logging 5.0*
Red Hatopenshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64 as a component of OpenShift Logging 5.0openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64
Red Hatopenshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x as a component of OpenShift Logging 5.0openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x
Red Hatopenshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x as a component of OpenShift Logging 5.0openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x
Red Hatopenshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64 as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64
Red Hatopenshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64 as a component of OpenShift Logging 5.0*
Red Hatopenshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x
Red Hatopenshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le as a component of OpenShift Logging 5.0*
Red Hatopenshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le
Red Hatopenshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x as a component of OpenShift Logging 5.0openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x
Red Hatopenshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64 as a component of OpenShift Logging 5.0openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64
Red Hatopenshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64 as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64
Red Hatopenshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x as a component of OpenShift Logging 5.0openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x
Red Hatopenshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le as a component of OpenShift Logging 5.0*

…and 6 more

Timeline

  • Jan 20, 2022 CVE Published
  • Mar 19, 2026 CVE Updated
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Security Advisory
  • May 1, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›