Red Hat Enterprise Linux Server 7 update for log4j
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2022-23305 CVE-2022-23307 CVE-2020-9493 CVE-2022-23302 |
| CWE-ID | CWE-89 CWE-502 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
log4j (Red Hat package) Operating systems & Components / Operating system package or component Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions Operating systems & Components / Operating system package or component Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions Operating systems & Components / Operating system package or component Red Hat Enterprise Linux Server - TUS Operating systems & Components / Operating system Red Hat Enterprise Linux Server - AUS Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, big endian Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux for Scientific Computing Operating systems & Components / Operating system Red Hat Enterprise Linux Desktop Operating systems & Components / Operating system Red Hat Enterprise Linux Workstation Operating systems & Components / Operating system Red Hat Enterprise Linux Server Operating systems & Components / Operating system |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) SQL injection
EUVDB-ID: #VU59691
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-23305
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the JDBCAppender. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Note, a non-default configuration with enabled JDBCAppender is required to exploit the vulnerability.
Install updates from vendor's website.
log4j (Red Hat package): 1.2.17-16.el7_3 - 1.2.17-17.el7_4
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server - TUS: 7.6 - 7.7
Red Hat Enterprise Linux Server - AUS: 7.3 - 7.7
Red Hat Enterprise Linux for Power, little endian: 7
Red Hat Enterprise Linux for Power, big endian: 7
Red Hat Enterprise Linux for IBM z Systems: 7
Red Hat Enterprise Linux for Scientific Computing: 7
Red Hat Enterprise Linux Desktop: 7
Red Hat Enterprise Linux Workstation: 7
Red Hat Enterprise Linux Server: 7
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2022:0442
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Deserialization of Untrusted Data
EUVDB-ID: #VU59693
Risk: High
CVSSv3.1:
CVE-ID: CVE-2022-23307,CVE-2020-9493
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
log4j (Red Hat package): 1.2.17-16.el7_3 - 1.2.17-17.el7_4
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server - TUS: 7.6 - 7.7
Red Hat Enterprise Linux Server - AUS: 7.3 - 7.7
Red Hat Enterprise Linux for Power, little endian: 7
Red Hat Enterprise Linux for Power, big endian: 7
Red Hat Enterprise Linux for IBM z Systems: 7
Red Hat Enterprise Linux for Scientific Computing: 7
Red Hat Enterprise Linux Desktop: 7
Red Hat Enterprise Linux Workstation: 7
Red Hat Enterprise Linux Server: 7
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2022:0442
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
3) Deserialization of Untrusted Data
EUVDB-ID: #VU59692
Risk: High
CVSSv3.1:
CVE-ID: CVE-2022-23302
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in JMSSink. A remote attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests and execute arbitrary code on the target system.
Note, a non-default configuration with support for JMSSink is required to exploit this vulnerability.
Install updates from vendor's website.
log4j (Red Hat package): 1.2.17-16.el7_3 - 1.2.17-17.el7_4
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.6 - 7.7
Red Hat Enterprise Linux Server - TUS: 7.6 - 7.7
Red Hat Enterprise Linux Server - AUS: 7.3 - 7.7
Red Hat Enterprise Linux for Power, little endian: 7
Red Hat Enterprise Linux for Power, big endian: 7
Red Hat Enterprise Linux for IBM z Systems: 7
Red Hat Enterprise Linux for Scientific Computing: 7
Red Hat Enterprise Linux Desktop: 7
Red Hat Enterprise Linux Workstation: 7
Red Hat Enterprise Linux Server: 7
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2022:0442
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
