VDB
RHSA-2022:1299
RHSA-2022:1299
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JNDI LDAP endpoint.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
Timeline
- Apr 11, 2022 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 29, 2026 CVE Updated
- May 29, 2026 Security Advisory
- May 29, 2026 Security Advisory
- May 29, 2026 Security Advisory
- May 29, 2026 Security Advisory
- May 29, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:1299 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=appplatform&version=7.4 advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index advisory
- https://issues.redhat.com/browse/JBEAP-22385 advisory
- https://issues.redhat.com/browse/JBEAP-22819 advisory
- https://issues.redhat.com/browse/JBEAP-22839 advisory
- https://issues.redhat.com/browse/JBEAP-22973 advisory
- https://issues.redhat.com/browse/JBEAP-23038 advisory
- https://issues.redhat.com/browse/JBEAP-23105 advisory
- https://issues.redhat.com/browse/JBEAP-23143 advisory
- https://issues.redhat.com/browse/JBEAP-23177 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1299.json advisory
- https://access.redhat.com/security/cve/CVE-2021-4104 advisory
- https://access.redhat.com/security/cve/CVE-2021-44228 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-45105 advisory
- https://access.redhat.com/security/cve/CVE-2022-23302 advisory
- https://www.openwall.com/lists/oss-security/2022/01/18/3 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-23305 advisory
- https://access.redhat.com/security/cve/CVE-2022-23307 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-23307 advisory
…and 54 more