Deserialization of Untrusted Data in Apache Log4j - CVE-2021-4104

Vulnerability identifier: #VU58977

CSH Severity: Medium

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-4104

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in JMSAppender, when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution.

Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.

Apache Log4j
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Workstation
CentOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Anolis OS
IBM Security Identity Manager Virtual Appliance
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
HPE Helion Openstack
SUSE OpenStack Cloud
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Ubuntu
openEuler
Crypto Hardware Initialization and Maintenance (CHIM)
NetAtlas Element Management System (EMS)
IBM Security Verify Access
IBM DS8000 Hardware Management Console
Silver Peak Orchestrator
Enhanced Interactive Unified Mediation (eIUM)
RecoverPoint Classic
IBM Security Directory Server
IBM Engineering Systems Design Rhapsody
Datacap
B2B Advanced Communications
Multi-Enterprise Integration Gateway
3PAR Service Processors
Extended Command-Line Interface (XCLI) Utility
Hyper-Scale Manager
DevOps
IBM Engineering Requirements Management DOORS Next
IBM Sterling Order Management
Fraud Risk Management (FRM)
IBM Data Studio Client
IBM Cloud Pak for Multicloud Management
IBM i Access Client Solutions
Red Hat OpenShift Container Platform
DB2 Recovery Expert for LUW
IBM Copy Services Manager
Jazz for Service Management
IBM Operations Analytics Predictive Insights
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Pak for Data System
Spectrum Discover
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Automation Manager
Dell Secure Connect Gateway
IBM Spectrum Control
IBM Global High Availability Mailbox
IBM Tivoli Monitoring
JBoss A-MQ
UCD - IBM UrbanCode Deploy
StoredIQ
WebSphere Service Registry and Repository
IBM Transformation Extender Advanced
IBM Security Verify Governance
Enterprise Manager Base Platform
Log Analysis
Netcool Operations Insight
QRadar User Behavior Analytics
Unified Mediation Bus
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
IBM Security Access Manager for Enterprise Single-Sign On
IBM Common Licensing
Security Director Insights
IBM Tivoli Netcool/OMNIbus Integration – Java Netcool Utility Library
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
eap7-hibernate (Red Hat package)
tomcat7 (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
tomcat8 (Red Hat package)
eap7-jboss-annotations (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
pcp-parfait-agent
parfait-javadoc
parfait-examples
parfait
kafka
eap7-yasson (Red Hat package)
log4j-jboss-logmanager (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
storm
storm-nimbus
storm-supervisor
log4j (Red Hat package)
log4j
log4j-manual
log4j-eap6 (Red Hat package)
log4j12-manual
log4j12-javadoc
log4j12
liblog4j1.2-java (Ubuntu package)
log4j-javadoc
rh-maven36-log4j12 (Red Hat package)
log4j12-help
eap7-xom (Red Hat package)
eap7-h2database (Red Hat package)
spark
eap7-avro (Red Hat package)
dev-embedded/arduino
games-server/minecraft-server
eap7-jboss-marshalling (Red Hat package)
openstack-monasca-thresh
eap7-wildfly-openssl (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
logstash
elasticsearch
venv-openstack-monasca-x86_64
eap7-xalan-j2 (Red Hat package)
openstack-monasca-agent
python-monasca-agent
eap7-activemq-artemis (Red Hat package)
eap7-log4j (Red Hat package)
eap7-jboss-vfs (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
zookeeper-server
snmp4j (Red Hat package)
eap7-ecj (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
net-wireless/unifi
app-backup/tsm
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Db2 Web Query for i
Oracle Utilities Testing Accelerator
IBM Tivoli Application Dependency Discovery Manager
IBM Content Navigator
JBoss Web Server
IBM Integrated Web Server (IWS)
Informix Dynamic Server
IBM Informix Dynamic Server on Cloud Pak for Data
Fuse
JBoss Enterprise Application Platform
IBM Integrated Application Server (IAS)
Oracle WebLogic Server
Red Hat Virtualization Manager
IBM Security Identity Governance and Intelligence (IGI)
Red Hat Single Sign-On
IBM Sterling Global Mailbox (GM)
JBoss Data Virtualization
Oracle Service Bus
IBM Navigator for i
Oracle Communications Order and Service Management
JBoss Data Grid
IBM Qradar SIEM
IBM Cognos Command Center
IBM Cognos Controller
Content Manager Enterprise Edition
IBM DB2
IBM Security Guardium
Oracle Retail Allocation
IBM Cloud Pak System
IntroSpect
HPE StoreServ Management Console
RSA Identity Governance and Lifecycle

Install updates from vendor's website.

Apache Log4j - update to 2.16.0
IBM Cloud Pak for Multicloud Management - update to 2.3.5
Jazz for Service Management - update to 1.1.3.25
IBM i Access Client Solutions - update to 1.1.8.7
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.11-1.Final_redhat_00002.1.el7eap, 1.15.11-1.Final_redhat_00002.1.el8eap
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
Spectrum Discover - update to 2.0.4.5
eap7-undertow (Red Hat package) - addressed in versions 2.2.16-1.Final_redhat_00001.1.el7eap, 2.2.16-1.Final_redhat_00001.1.el8eap
IBM Security Guardium Key Lifecycle Manager (GKLM) - addressed in versions 4.1 FP3, 4.1.1 FP3
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008 LA2, 3.2.0 IF004
JBoss Web Server - update to 3.1.14
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.7.13-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el8eap
IBM Informix Dynamic Server on Cloud Pak for Data - update to 4.0.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.5
ovirt-engine (Red Hat package) - update to 4.4.10.6-0.1.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.4.10-1.el8ev
Red Hat OpenShift Container Platform - addressed in versions 4.6.52, 4.7.40
Dell Secure Connect Gateway - update to 5.12.00.10
RecoverPoint Classic - update to 5.1 SP4 P4
eap7-hibernate (Red Hat package) - addressed in versions 5.3.25-1.Final_redhat_00002.1.el7eap, 5.3.25-1.Final_redhat_00002.1.el8eap
IBM Spectrum Control - update to 5.4.5.1
DB2 Recovery Expert for LUW - update to 5.5.0.1 IF4
IBM Global High Availability Mailbox - update to 6.0.3.6
IBM Sterling Global Mailbox (GM) - addressed in versions 6.1.0.5, 6.1.1.1
IBM Tivoli Monitoring - update to 6.3.0.7 Fix Pack 7 Service Pack 10
Fuse - addressed in versions 6.3.20, 7.10.1
JBoss A-MQ - update to 6.3.20
JBoss Data Virtualization - addressed in versions 6.4.8.SP1, 6.4.8 SP2
JBoss Enterprise Application Platform - addressed in versions 7.3.11, 7.4.4
UCD - IBM UrbanCode Deploy - update to 7.1.2.1
tomcat7 (Red Hat package) - update to 7.0.70-46.ep7.el7
JBoss Data Grid - update to 7.3.9
Red Hat Single Sign-On - addressed in versions 7.4.10, 7.5.1
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 7, 7.5.0 Update Package 3 Interim Fix 02, 7.5.0 Update Pack 7 IF01
eap7-wildfly (Red Hat package) - addressed in versions 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el8eap
StoredIQ - update to siq_7_6_0_22_log4j_2_17_1_
IBM Security Directory Server - update to 8.0.1.18
tomcat8 (Red Hat package) - update to 8.0.36-49.ep7.el7
WebSphere Service Registry and Repository - update to 8.5.6.3
Content Manager Enterprise Edition - update to 8.7
IBM Transformation Extender Advanced - addressed in versions 9.0.2.6, 10.0.1.7
Datacap - update to 9.1.10
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF15
IBM DB2 - addressed in versions 11.5.6.0, 11.5.7.0
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el8eap
pcp-parfait-agent - update to 0.5.4-4
parfait-javadoc - update to 0.5.4-4
parfait-examples - update to 0.5.4-4
parfait - update to 0.5.4-4
kafka - addressed in versions 0.10.2.2-3.2.1, 0.10.2.2-5.9.1
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
eap7-yasson (Red Hat package) - addressed in versions 1.0.10-1.redhat_00001.1.el7eap, 1.0.10-1.redhat_00001.1.el8eap
log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.1.4-3.Final_redhat_00002.1.ep6.el6, 1.1.4-3.Final_redhat_00002.1.ep6.el7
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.2.2-1.Final_redhat_00002.1.el7eap, 1.2.2-1.Final_redhat_00002.1.el8eap, 1.2.2-2.Final_redhat_00002.1.el7eap
storm - addressed in versions 1.2.3-3.5.1, 1.2.3-3.8.2
storm-nimbus - addressed in versions 1.2.3-3.5.1, 1.2.3-3.8.2
storm-supervisor - addressed in versions 1.2.3-3.5.1, 1.2.3-3.8.2
log4j (Red Hat package) - addressed in versions 1.2.14-6.5.el6_10, 1.2.17-16.el7_3, 1.2.17-17.el7_4
log4j - addressed in versions 1.2.15-26.32.17.1, 1.2.15-126.6.1, 1.2.17-5.6.1
log4j-manual - addressed in versions 1.2.15-126.6.1, 1.2.17-5.6.1
log4j-eap6 (Red Hat package) - addressed in versions 1.2.17-3.redhat_00008.1.ep6.el6, 1.2.17-3.redhat_00008.1.ep6.el7
log4j12-manual - update to 1.2.17-4.3.1
log4j12-javadoc - update to 1.2.17-4.3.1
log4j12 - update to 1.2.17-4.3.1
liblog4j1.2-java (Ubuntu package) - addressed in versions 1.2.17-8+deb10u1ubuntu0.1, 1.2.17-9ubuntu0.1, 1.2.17-10ubuntu0.21.04.1, 1.2.17-10ubuntu0.21.10.1
log4j - update to 1.2.17-18
log4j-manual - update to 1.2.17-18
log4j-javadoc - update to 1.2.17-18
rh-maven36-log4j12 (Red Hat package) - update to 1.2.17-23.3.el7
log4j12 - update to 1.2.17-25
log4j12-help - update to 1.2.17-25
eap7-xom (Red Hat package) - addressed in versions 1.3.7-1.redhat_00001.1.el7eap, 1.3.7-1.redhat_00001.1.el8eap
Log Analysis - update to 1.3.7.2
eap7-h2database (Red Hat package) - update to 1.4.197-3.redhat_00004.1.el7eap
spark - addressed in versions 1.6.3-8.9.2, 2.2.3-5.6.1
Netcool Operations Insight - update to 1.6.7
eap7-avro (Red Hat package) - update to 1.7.6-8.redhat_00003.1.el7eap
dev-embedded/arduino - update to 1.8.19
games-server/minecraft-server - update to 1.18.1
eap7-jboss-marshalling (Red Hat package) - update to 2.0.15-1.Final_redhat_00001.1.el7eap
openstack-monasca-thresh - addressed in versions 2.1.1-4.3.1, 2.1.1-5.3.1
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.0-3.Final_redhat_00002.1.el7eap, 2.2.0-3.Final_redhat_00002.1.el8eap
eap7-xml-security (Red Hat package) - update to 2.2.3-2.redhat_00001.1.el7eap
eap7-wss4j (Red Hat package) - update to 2.3.3-2.redhat_00001.1.el7eap
IBM Cloud Pak System - update to 2.3.3.4
logstash - addressed in versions 2.4.1-5.7.1, 2.4.1-7.3.1
elasticsearch - addressed in versions 2.4.2-5.3.1, 2.4.2-6.3.1
IntroSpect - update to 2.5.0.7
venv-openstack-monasca-x86_64 - update to 2.7.1~dev10-3.29.1
eap7-xalan-j2 (Red Hat package) - update to 2.7.1-38.redhat_00015.1.el7eap
openstack-monasca-agent - update to 2.8.2~dev5-3.15.1
python-monasca-agent - update to 2.8.2~dev5-3.15.1
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-7.redhat_00034.1.el7eap, 2.16.0-7.redhat_00034.1.el8eap
eap7-log4j (Red Hat package) - addressed in versions 2.17.1-1.redhat_00001.1.el7eap, 2.17.1-1.redhat_00001.1.el8eap
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.16-1.Final_redhat_00001.1.el7eap, 3.2.16-1.Final_redhat_00001.1.el8eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.9-1.Final_redhat_00001.1.el7eap, 3.3.9-1.Final_redhat_00001.1.el8eap
eap7-apache-cxf (Red Hat package) - update to 3.4.10-1.SP1_redhat_00001.1.el7eap
zookeeper-server - addressed in versions 3.4.10-3.9.1, 3.4.10-3.12.1, 3.4.13-3.6.1, 3.4.13-3.9.1
snmp4j (Red Hat package) - update to 3.6.4-0.1.el8ev
HPE StoreServ Management Console - update to 3.8.2.1
eap7-ecj (Red Hat package) - addressed in versions 3.26.0-1.redhat_00002.1.el7eap, 3.26.0-1.redhat_00002.1.el8eap
QRadar User Behavior Analytics - update to 4.1.8
Unified Mediation Bus - update to 4.4
3PAR Service Processors - update to 5.0.9.2
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.4-1.Final_redhat_00001.1.el7eap, 5.4.4-1.Final_redhat_00001.1.el8eap
Extended Command-Line Interface (XCLI) Utility - update to 5.5.4
Hyper-Scale Manager - update to 5.5.4
eap7-narayana (Red Hat package) - addressed in versions 5.11.4-1.Final_redhat_00001.1.el7eap, 5.11.4-1.Final_redhat_00001.1.el8eap
IBM Copy Services Manager - update to 6.3.2
net-wireless/unifi - update to 6.5.55
DevOps - update to 7.0.0.2
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.10
RSA Identity Governance and Lifecycle - update to 8.0.0 P03 HF01
app-backup/tsm - update to 8.1.13.3
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 8.2
IBM Security Access Manager for Enterprise Single-Sign On - update to 8.2.2 Fix Pack 15
IBM Common Licensing - update to 9.0.0.1
eap7-objectweb-asm (Red Hat package) - addressed in versions 9.1.0-1.redhat_00002.1.el7eap, 9.1.0-1.redhat_00002.1.el8eap
IBM Engineering Requirements Management DOORS Next - addressed in versions 9.6.1.13, 9.7.2.6
IBM Sterling Order Management - update to 10.0.2403.1
eap7-infinispan (Red Hat package) - addressed in versions 11.0.15-1.Final_redhat_00001.1.el7eap, 11.0.15-1.Final_redhat_00001.1.el8eap
Informix Dynamic Server - addressed in versions 12.10.xC15, 14.10.FC7W1
Fraud Risk Management (FRM) - addressed in versions 14.0.2 Revision 10, 14.1 Revision 3
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.4-1.redhat_00003.1.el7sso, 15.0.4-1.redhat_00003.1.el8sso
Security Director Insights - update to 23.1R1
IBM Tivoli Netcool/OMNIbus Integration – Java Netcool Utility Library - update to 33.2
IBM DS8000 Hardware Management Console - addressed in versions 88.50.184.0, 89.12.8.0

• https://access.redhat.com/security/cve/CVE-2021-4104
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126

• Insecure deserialization in Apache Log4j 1.2
• OpenShift Container Platform 4.6 update for log4j
• Remote code execution in Zyxel NetAtlas EMS (Apache Log4j component)
• Red Hat Enterprise Linux update for log4j
• CentOS 7 update for log4j
• Multiple vulnerabilities in IBM DB2 (Apache Log4j component)
• Remote code execution in IBM Spectrum Control (Apache Log4j component)
• IBM Security Access Manager update for log4j library
• Multiple vulnerabilities in IBM Tivoli Monitoring
• IBM Urbancode Deploy update for Apache Log4j
• IBM Navigator for i update for Apache Log4j
• IBM Integrated Web Server update for Apache Log4j
• IBM Integrated Application Server update for Apache Log4j
• IBM i Access Client Solutions update for Apache Log4j
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager (GKLM)
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Amazon Linux AMI update for log4j
• Red Hat Enterprise Linux 8.4 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8.2 update for the parfait:0.5 module
• Red Hat Enterprise Linux 8.1 update for the parfait:0.5 module
• Code injection in IBM Data Studio client (Apache Log4j component)
• Multiple vulnerabilities in IBM Db2 Web Query for i
• Deserialization of Untrusted Data in Oracle Retail Allocation
• Multiple vulnerabilities in Red Hat Data Grid
• Red Hat JBoss Enterprise Application Platform 7.4 update for Apache Log4j
• Red Hat JBoss Enterprise Application Platform 6.4 update for Apache Log4j
• Multiple vulnerabilities in IBM Informix Dynamic Server on Cloud Pak for Data
• Multiple vulnerabilities in IBM Informix Dynamic Server
• Red Hat Single Sign-On update for Apache Log4j
• Multiple vulnerabilities in Red Hat Single Sign-On 7.5 for Red Hat Enterprise Linux 8
• Multiple vulnerabilities in Red Hat Single Sign-On for Red Hat Enterprise Linux 7
• Multiple vulnerabilities in Red Hat Single Sign-On
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat JBoss Web Server 3.1
• Multiple vulnerabilities in Red Hat JBoss Fuse and A-MQ
• IBM Cloud Pak for Data System 2.0 update for openshift-logging
• Multiple vulnerabilities in Red Hat Fuse 7.10
• IBM Security Guardium update for Apache log4j
• DB2 Recovery Expert for LUW update for Apache Log4j
• WebSphere Service Registry and Repository update for Apache Log4j
• Remote code execution in IBM Transformation Extender Advanced
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• JBoss Enterprise Application Platform 7.4 for RHEL 8 update for log4j
• JBoss Enterprise Application Platform 7.4 for RHEL 7 update for log4j
• IBM Security Verify Governance update for Apache Log4j
• IBM Security Identity Governance and Intelligence update for Apache Log4j
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM DS8000 Hardware Management Console
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus Common Integration Libraries
• SUSE update for storm
• SUSE update for storm-kit
• SUSE update for log4j
• SUSE update for log4j
• SUSE update for log4j12
• SUSE update for log4j
• SUSE update for logstash, elasticsearch, kafka, zookeeper, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-thresh
• SUSE update for logstash
• SUSE update for openstack-monasca-agent, spark, spark-kit, zookeeper
• Ubuntu update for apache-log4j1.2
• Remote code execution in IBM StoredIQ
• Remote code execution in IBM Sterling Global Mailbox
• Remote code execution in IBM Cloud Pak for Multicloud Management Infrastructure Management
• Remote code execution in IBM Content Manager Enterprise Edition
• Remote code execution in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Remote code execution in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Security Identity Manager Virtual Appliance
• Multiple vulnerabilities in IBM Spectrum Discover
• Gentoo update for IBM Spectrum Protect
• Remote code execution in IBM Engineering Requirements Management DOORS/DWA
• Remote code execution in IBM Security Directory Suite
• Remote code execution in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Enterprise Manager Base Platform
• IBM QRadar SIEM update for Apache Log4j
• Remote code execution in IBM Tivoli Application Dependency Discovery Manager
• Deserialization of untrusted data in IBM Engineering Systems Design Rhapsody
• Deserialization of untrusted data in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Red Hat Software Collections update for rh-maven36-log4j12
• Deserialization of untrusted data in IBM B2B Advanced Communications
• SUSE update for openstack-monasca-agent, spark, spark-kit, zookeeper
• Multiple vulnerabilities in HPE Fraud Risk Management Software Series
• Multiple vulnerabilities in HPE 3PAR Service Processors
• Multiple vulnerabilities in HPE enhanced Interactive Unified Mediation (eIUM)
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Deserialization of Untrusted Data in IBM Cloud Automation Manager
• Deserialization of untrusted data in IBM Copy Services Manager
• Multiple vulnerabilities in Oracle Service Bus
• Multiple vulnerabilities in IBM Security Access Manager for Enterprise Single Sign-On
• Multiple vulnerabilities in Netcool Operations Insight
• Gentoo update for Ubiquiti UniFi
• Multiple vulnerabilities in IBM QRadar SIEM
• Gentoo update for Minecraft Server
• Gentoo update for Arduino
• Multiple vulnerabilities in IBM Hyper-Scale Manager
• Deserialization of untrusted data in IBM Extended Command-Line Interface (XCLI) Utility
• Multiple vulnerabilities in Juniper Networks Security Director Insights
• Deserialization of Untrusted Data in Oracle Communications Order and Service Management
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• openEuler update for log4j12
• openEuler 22.03 LTS update for log4j12
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM DevOps Release
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
• Anolis OS update for parfait:0.5 module
• Anolis OS update for log4j
• Multiple vulnerabilities in HPE 3PAR/Primera StoreServ Management Console (SSMC)
• Multiple vulnerabilities in HPE Aruba Silver Peak Orchestrator and Aruba IntroSpect
• RSA Governance and Lifecycle update for Apache Log4j
• Multiple vulnerabilities in IBM Jazz for Service Management
• Multiple vulnerabilities in Crypto Hardware Initialization and Maintenance (CHIM) as shipped with IBM Common Cryptographic Architecture (CCA)
• Multiple vulnerabilities in IBM Datacap
• Multiple vulnerabilities in IBM Content Navigator