Code Injection in Apache Log4j - CVE-2021-44832

Vulnerability identifier: #VU59098

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-44832

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote user with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.

Apache Log4j
Enhanced Interactive Unified Mediation (eIUM)
UIoT
Spectator
Unified Data Management (UDM)
Authentication Server Function (AUSF)
Unstructured Data Storage Function (UDSF)
User Data Repository (UDR)
Oracle Banking Platform
dgs-framework
Oracle Utilities Framework
Oracle Healthcare Master Person Index
RecoverPoint Classic
Java agent
Oracle Communications Network Charging and Control
Oracle Agile Engineering Data Management
Oracle Communications ASAP
Oracle FLEXCUBE Universal Banking
Oracle FLEXCUBE Private Banking
Oracle Policy Automation
Oracle Data Integrator
Oracle Communications User Data Repository
Oracle Retail Store Inventory Management
Oracle Retail Service Backbone
Oracle Retail Customer Insights
Oracle Retail Xstore Point of Service
Oracle Retail Order Broker
3PAR Service Processors
webMethods BPM
Fraud Risk Management (FRM)
Silver Peak Orchestrator
API Gateway
AMQ Streams
Karaf
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Fuse
IBM WebSphere Application Server
Oracle WebLogic Server
Primavera Gateway
API Manager
Oracle Health Sciences InForm
Cloudera Data Platform Private Cloud Base for IBM
Oracle Hospitality Gift and Loyalty
Oracle Managed File Transfer
Oracle WebCenter Sites
Oracle Retail Price Management
Oracle Retail Data Extractor for Merchandising
Oracle Communications Element Manager
Oracle Communications Session Route Manager
IBM Telco Network Cloud Manager - Performance (TNCP)
IBM Netcool Agile Service Manager
IBM Operations Analytics Predictive Insights
Log Analysis
Management Cloud Engine
Oracle Communications Cloud Native Core Network Repository Function
IBM Spectrum Copy Data Management
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Conductor
Oracle Health Sciences Data Management Workbench
IBM Security Guardium Key Lifecycle Manager (GKLM)
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
Oracle Banking Loans Servicing
Oracle Banking Deposits and Lines of Credit Servicing
IBM Sterling Secure Proxy
Oracle Product Lifecycle Analytics
IBM Sterling Connect:Direct for UNIX
Oracle Communications EAGLE FTP Table Base Retrieval
OpenShift Logging
IBM Sterling External Authentication Server
Red Hat Integration Camel-K
IBM Sterling Control Center
IBM Tivoli Monitoring
Oracle Enterprise Command Center Framework
Oracle E-Business Suite Information Discovery
IBM Spectrum Symphony
Oracle Communications WebRTC Session Controller
Oracle Communications Network Integrity
Oracle Communications IP Service Activator
Oracle Communications Unified Inventory Management
Oracle Financial Services Model Management and Governance
Netcool/OMNIbus
Oracle Healthcare Data Repository
Oracle Communications Diameter Signaling Router
Oracle Identity Manager Connector
Oracle Health Sciences Empirica Signal
IBM Spectrum Protect Plus
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
RSA RT
Oracle Communications Performance Intelligence Center (PIC) Software
Infrastructure Technology
Oracle Identity Management Suite
Enterprise Manager Base Platform
Oracle Banking Treasury Management
Oracle Banking Trade Finance
Oracle Payment Interface
Oracle Hospitality Token Proxy Service
Dell EMC Data Protection Search
Primavera P6 Enterprise Project Portfolio Management
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications EAGLE Element Management System
Operations Dashboard
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
Dell EMC Unisphere Central
IBM Cloud Application Performance Management (APM)
Oracle Communications Session Report Manager
Hyperion Financial Management
Hyperion Profitability and Cost Management
Security Director Insights
Oracle Insurance Data Gateway
Oracle Communications Convergence
Oracle Communications Interactive Session Recorder
Oracle Communications MetaSolv Solution
Oracle Communications Services Gatekeeper
Oracle Communications Instant Messaging Server
Oracle Hyperion BI+
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
thrift-glib
libthrift-java
perl-thrift
python3-thrift
thrift-debugsource
thrift-devel
thrift-qt
thrift
wildfly-elytron
wildfly-elytron-javadoc
eap7-yasson (Red Hat package)
wildfly-common-help
wildfly-common
wildfly-security-manager
wildfly-security-manager-javadoc
wildfly-server-provisioning-maven-plugin
wildfly-build-tools
wildfly-build-tools-javadoc
wildfly-feature-pack-build-maven-plugin
wildfly-server-provisioning
wildfly-server-provisioning-standalone
eap7-xom (Red Hat package)
avalon-logkit
avalon-logkit-help
eap7-wildfly-openssl (Red Hat package)
wildfly-core
wildfly-core-javadoc
wildfly-core-feature-pack
HikariCP-help
HikariCP
jenkins-json-lib
json-lib-help
json-lib
liblog4j2-java (Ubuntu package)
eap7-activemq-artemis (Red Hat package)
log4j-jcl
log4j-bom
log4j-jmx-gui
log4j-web
log4j-slf4j
log4j-taglib
log4j-help
log4j
eap7-log4j (Red Hat package)
mx4j
mx4j-javadoc
mx4j-manual
metrics-annotation
metrics
metrics-servlet
metrics-parent
metrics-servlets
metrics-benchmarks
metrics-doc
metrics-ehcache
metrics-ganglia
metrics-graphite
metrics-httpasyncclient
metrics-logback
metrics-log4j2
metrics-log4j
metrics-jvm
metrics-json
metrics-jersey2
metrics-jdbi
metrics-healthchecks
metrics-httpclient
metrics-javadoc
datanucleus-api-jdo-javadoc
mybatis
datanucleus-api-jdo
mybatis-javadoc
datanucleus-rdbms-javadoc
datanucleus-rdbms
datanucleus-core-javadoc
datanucleus-core
eap7-jboss-vfs (Red Hat package)
springframework-help
springframework-aop
springframework-expression
springframework-instrument
springframework-context
springframework-web
springframework-tx
springframework-oxm
springframework-orm-hibernate4
springframework-orm
springframework-jms
springframework-jdbc
springframework-beans
springframework
jboss-logging
jboss-logging-javadoc
eap7-hal-console (Red Hat package)
jgroups
jgroups-help
eap7-ecj (Red Hat package)
netty-help
netty
avalon-framework-help
avalon-framework
eap7-jbossws-cxf (Red Hat package)
eap7-narayana (Red Hat package)
infinispan-help
infinispan
eap7-objectweb-asm (Red Hat package)
eap7-infinispan (Red Hat package)
IBM App Connect for Manufacturing
Red Hat OpenShift Container Platform
Enterprise Manager for Peoplesoft
Primavera Unifier
Oracle Autovue for Agile Product Lifecycle Management
Apache Struts
Siebel UI Framework
EMC Integrated Data Protection Appliance
Zoho ManageEngine EventLog Analyzer
Oracle Health Sciences Information Manager
Oracle Agile PLM MCAD Connector
Oracle Insurance Insbridge Rating and Underwriting
IBM Qradar SIEM
Event Streams
IBM Cognos Controller
JBoss Data Grid
Oracle Hyperion Tax Provision
Solaris Cluster
Ubuntu
openEuler
Fedora
Oracle Healthcare Translational Research
Oracle Communications Convergent Charging Controller
Oracle Healthcare Foundation
Oracle Hospitality Suite8
Oracle Hospitality Labor Management
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Demantra Demand Management
Instantis EnterpriseTrack
Siebel Apps - Marketing
Hyperion Planning
Oracle Taleo Platform
SecureTransport
Oracle Communications Order and Service Management
MySQL Enterprise Monitor
IBM DB2
Oracle Communications BRM - Elastic Charging Engine
Oracle Essbase
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle Hospitality Reporting and Analytics
Oracle Agile PLM Framework
Ghidra
IBM App Connect Enterprise
EntireX
Oracle JDeveloper
Oracle SQL Developer
Oracle Policy Automation for Mobile Devices
Oracle Enterprise Manager Ops Center
Oracle Retail Integration Bus
Oracle Retail Fiscal Management
Oracle Banking Payments
Oracle Retail Invoice Matching
Oracle Retail Assortment Planning
Oracle Retail Merchandising System
Oracle Retail EFTLink
IntroSpect
HPE StoreServ Management Console
RecoverPoint for VMs

Install updates from vendor's website.

Apache Log4j - update to 2.17.1
API Gateway - update to February 2022
API Manager - update to February 2022
Spectator - update to 1.0.12
IBM Netcool Agile Service Manager - update to 1.1.10
Log Analysis - update to 1.3.7.2
AMQ Streams - addressed in versions 1.6.7, 2.0.0
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-15.Final_redhat_00014.1.el7eap, 1.10.0-15.Final_redhat_00014.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.11-1.Final_redhat_00002.1.el7eap, 1.15.11-1.Final_redhat_00002.1.el8eap
Unified Data Management (UDM) - addressed in versions 1.2109.2, 1.2112.0
Authentication Server Function (AUSF) - addressed in versions 1.2109.1, 1.2112.0
Unstructured Data Storage Function (UDSF) - update to 1.2112.0
User Data Repository (UDR) - update to 1.2112.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.16-1.Final_redhat_00001.1.el7eap, 2.2.16-1.Final_redhat_00001.1.el8eap
IBM Spectrum Copy Data Management - update to 2.2.14.3
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fixpack 4
Apache Struts - update to 2.5.28.3
EMC Integrated Data Protection Appliance - update to 2.7.3
IBM Security Guardium Key Lifecycle Manager (GKLM) - addressed in versions 4.1 FP3, 4.1.1 FP3
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.6-1.Final_redhat_00001.1.el7eap, 3.8.6-1.Final_redhat_00001.1.el8eap
Red Hat OpenShift Container Platform - addressed in versions 3.11.570, 4.6.54, 4.7.43, 4.8.31
dgs-framework - update to 4.9.16
Karaf - addressed in versions 4.2.15, 4.3.6
OpenShift Logging - addressed in versions 5.0.12, 5.1.7, 5.2.6, 5.3.3
RecoverPoint Classic - update to 5.1 SP4 P4
Oracle Insurance Insbridge Rating and Underwriting - update to 5.6.0.0
eap7-hibernate (Red Hat package) - addressed in versions 5.3.25-1.Final_redhat_00002.1.el7eap, 5.3.25-1.Final_redhat_00002.1.el8eap
SecureTransport - update to 5.5-20220127
Java agent - update to 7.5.0
Red Hat Integration Camel-K - update to 6.1.3
JBoss Enterprise Application Platform - update to 7.4.4
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 7, 7.5.0 Update Package 3 Interim Fix 02
eap7-wildfly (Red Hat package) - addressed in versions 7.4.4-3.GA_redhat_00011.1.el7eap, 7.4.4-3.GA_redhat_00011.1.el8eap
Fuse - addressed in versions 7.8.2, 7.9.1, 7.10.1
Netcool/OMNIbus - update to 8.1.0.28
Ghidra - update to 10.1.2
Event Streams - addressed in versions 10.2.1, 10.5.0
IBM Spectrum Protect Plus - update to 10.1.9.3
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.9.3
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.9.3
RSA RT - update to 11.1 2022.04
IBM Cognos Analytics - addressed in versions 11.0.13.5, 11.1.7.8, 11.2.1.3
EntireX - update to 11.1.1
Oracle Hyperion BI+ - update to 11.2.8.0
Infrastructure Technology - update to 11.2.8.0
IBM DB2 - addressed in versions 11.5.6.0, 11.5.7.0
Oracle FLEXCUBE Universal Banking - addressed in versions 12.4.0, 14.3.0
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.5.1
Oracle Communications Offline Mediation Controller - update to 12.0.0.5.1
Oracle Policy Automation - update to 12.2.25
Oracle Retail Integration Bus - update to 16.0.3.0
Oracle Retail Service Backbone - update to 16.0.3.0
Dell EMC Data Protection Search - addressed in versions 19.6.1, 19.6.2
Siebel Apps - Marketing - update to 22.2
Zoho ManageEngine EventLog Analyzer - update to 12215
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.0-2.Final_redhat_00002.1.el8eap
thrift-glib - update to 0.14.0-6
libthrift-java - update to 0.14.0-6
perl-thrift - update to 0.14.0-6
python3-thrift - update to 0.14.0-6
thrift-debugsource - update to 0.14.0-6
thrift-devel - update to 0.14.0-6
thrift-qt - update to 0.14.0-6
thrift - update to 0.14.0-6
wildfly-elytron - update to 1.0.2-3
wildfly-elytron-javadoc - update to 1.0.2-3
eap7-yasson (Red Hat package) - addressed in versions 1.0.10-1.redhat_00001.1.el7eap, 1.0.10-1.redhat_00001.1.el8eap
wildfly-common-help - update to 1.1.0-9
wildfly-common - update to 1.1.0-9
wildfly-security-manager - update to 1.1.2-3
wildfly-security-manager-javadoc - update to 1.1.2-3
wildfly-server-provisioning-maven-plugin - update to 1.1.6-3
wildfly-build-tools - update to 1.1.6-3
wildfly-build-tools-javadoc - update to 1.1.6-3
wildfly-feature-pack-build-maven-plugin - update to 1.1.6-3
wildfly-server-provisioning - update to 1.1.6-3
wildfly-server-provisioning-standalone - update to 1.1.6-3
eap7-xom (Red Hat package) - addressed in versions 1.3.7-1.redhat_00001.1.el7eap, 1.3.7-1.redhat_00001.1.el8eap
Netcool Operations Insight - update to 1.6.7
avalon-logkit - update to 2.1-35
avalon-logkit-help - update to 2.1-35
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.0-3.Final_redhat_00002.1.el7eap, 2.2.0-3.Final_redhat_00002.1.el8eap
wildfly-core - update to 2.2.0-4
wildfly-core-javadoc - update to 2.2.0-4
wildfly-core-feature-pack - update to 2.2.0-4
HikariCP-help - update to 2.4.3-7
HikariCP - update to 2.4.3-7
jenkins-json-lib - update to 2.4-20
json-lib-help - update to 2.4-20
json-lib - update to 2.4-20
IntroSpect - update to 2.5.0.7
liblog4j2-java (Ubuntu package) - addressed in versions 2.12.4-0ubuntu0.1, 2.17.1-0.20.04.1, 2.17.1-0.21.04.1, 2.17.1-0.21.10.1
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-7.redhat_00034.1.el7eap, 2.16.0-7.redhat_00034.1.el8eap
log4j-jcl - addressed in versions 2.17.0-3, 2.17.0-4
log4j-bom - addressed in versions 2.17.0-3, 2.17.0-4
log4j-jmx-gui - addressed in versions 2.17.0-3, 2.17.0-4
log4j-web - addressed in versions 2.17.0-3, 2.17.0-4
log4j-slf4j - addressed in versions 2.17.0-3, 2.17.0-4
log4j-taglib - addressed in versions 2.17.0-3, 2.17.0-4
log4j-help - addressed in versions 2.17.0-3, 2.17.0-4
log4j - addressed in versions 2.17.0-3, 2.17.0-4
log4j - addressed in versions 2.17.1-1.fc34, 2.17.1-1.fc35
eap7-log4j (Red Hat package) - addressed in versions 2.17.1-1.redhat_00001.1.el7eap, 2.17.1-1.redhat_00001.1.el8eap
mx4j - update to 3.0.1-4
mx4j-javadoc - update to 3.0.1-4
mx4j-manual - update to 3.0.1-4
metrics-annotation - update to 3.1.2-4
metrics - update to 3.1.2-4
metrics-servlet - update to 3.1.2-4
metrics-parent - update to 3.1.2-4
metrics-servlets - update to 3.1.2-4
metrics-benchmarks - update to 3.1.2-4
metrics-doc - update to 3.1.2-4
metrics-ehcache - update to 3.1.2-4
metrics-ganglia - update to 3.1.2-4
metrics-graphite - update to 3.1.2-4
metrics-httpasyncclient - update to 3.1.2-4
metrics-logback - update to 3.1.2-4
metrics-log4j2 - update to 3.1.2-4
metrics-log4j - update to 3.1.2-4
metrics-jvm - update to 3.1.2-4
metrics-json - update to 3.1.2-4
metrics-jersey2 - update to 3.1.2-4
metrics-jdbi - update to 3.1.2-4
metrics-healthchecks - update to 3.1.2-4
metrics-httpclient - update to 3.1.2-4
metrics-javadoc - update to 3.1.2-4
datanucleus-api-jdo-javadoc - update to 3.2.8-4
mybatis - update to 3.2.8-4
datanucleus-api-jdo - addressed in versions 3.2.8-4, 3.2.15-4
mybatis-javadoc - update to 3.2.8-4
datanucleus-rdbms-javadoc - update to 3.2.13-4
datanucleus-rdbms - update to 3.2.13-4
datanucleus-core-javadoc - update to 3.2.15-4
datanucleus-core - update to 3.2.15-4
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.16-1.Final_redhat_00001.1.el7eap, 3.2.16-1.Final_redhat_00001.1.el8eap
springframework-help - update to 3.2.18-11
springframework-aop - update to 3.2.18-11
springframework-expression - update to 3.2.18-11
springframework-instrument - update to 3.2.18-11
springframework-context - update to 3.2.18-11
springframework-web - update to 3.2.18-11
springframework-tx - update to 3.2.18-11
springframework-oxm - update to 3.2.18-11
springframework-orm-hibernate4 - update to 3.2.18-11
springframework-orm - update to 3.2.18-11
springframework-jms - update to 3.2.18-11
springframework-jdbc - update to 3.2.18-11
springframework-beans - update to 3.2.18-11
springframework - update to 3.2.18-11
jboss-logging - update to 3.3.0-8
jboss-logging-javadoc - update to 3.3.0-8
eap7-hal-console (Red Hat package) - addressed in versions 3.3.9-1.Final_redhat_00001.1.el7eap, 3.3.9-1.Final_redhat_00001.1.el8eap
jgroups - update to 3.6.10-9
jgroups-help - update to 3.6.10-9
HPE StoreServ Management Console - update to 3.8.2.1
eap7-ecj (Red Hat package) - addressed in versions 3.26.0-1.redhat_00002.1.el7eap, 3.26.0-1.redhat_00002.1.el8eap
Dell EMC Unisphere Central - update to 4.0.10.1673904
netty-help - update to 4.1.13-16
netty - update to 4.1.13-16
avalon-framework-help - update to 4.3-24
avalon-framework - addressed in versions 4.3-24, 4.3-25
3PAR Service Processors - update to 5.0.9.2
RecoverPoint for VMs - update to 5.3.3
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.4-1.Final_redhat_00001.1.el7eap, 5.4.4-1.Final_redhat_00001.1.el8eap
eap7-narayana (Red Hat package) - addressed in versions 5.11.4-1.Final_redhat_00001.1.el7eap, 5.11.4-1.Final_redhat_00001.1.el8eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
JBoss Data Grid - update to 8.2.3
infinispan-help - update to 8.2.4-11
infinispan - update to 8.2.4-11
Oracle Communications Element Manager - update to 9.0
Oracle Communications Session Route Manager - update to 9.0
Oracle Communications Session Report Manager - update to 9.0
eap7-objectweb-asm (Red Hat package) - addressed in versions 9.1.0-1.redhat_00002.1.el7eap, 9.1.0-1.redhat_00002.1.el8eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.15-1.Final_redhat_00001.1.el7eap, 11.0.15-1.Final_redhat_00001.1.el8eap
webMethods BPM - update to 11.1 Fix 6
Hyperion Planning - update to 11.2.8.0
Hyperion Financial Management - update to 11.2.8.0
Hyperion Profitability and Cost Management - update to 11.2.8.0
Oracle Hyperion Tax Provision - update to 11.2.8.0
Fraud Risk Management (FRM) - addressed in versions 14.0.2 Revision 10, 14.1 Revision 3
Oracle SQL Developer - update to 21.4.2
Oracle Taleo Platform - update to 22.1
Security Director Insights - update to 23.1R1

• https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
• https://issues.apache.org/jira/browse/LOG4J2-3293
• https://logging.apache.org/log4j/2.x/security.html

• Remote code execution via JDBC Appender in Apache Log4j
• Netflix Spectator update for Apache Log4j
• IBM WebSphere Application Server update for Apache Log4j
• Apache Struts update for Log4j library
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Remote code execution in Zoho ManageEngine EventLog Analyzer
• Code Injection in IBM Sterling Secure Proxy
• Code Injection in IBM Sterling External Authentication Server
• Remote code execution in IBM App Connect Enterprise (Apache Log4j component)
• newrelic-java-agent update for Apache Log4j
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager (GKLM)
• Multiple vulnerabilities in IBM Spectrum Symphony
• Netflix dgs-framework update for Apache Log4j
• Remote code execution in IBM App Connect for Manufacturing
• Multiple vulnerabilities in IBM Cognos Analytics
• Remote code execution in Apache Foundation Karaf
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in IBM Cognos Controller
• Code Injection in Automation Assets in IBM Cloud Pak for Integration (CP4I)
• Remote code execution in IBM Cloud Pak for Multicloud Management Monitoring
• OpenShift Logging update for Apache Log4j
• Remote code execution in Primavera Gateway (Apache Log4j component)
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in OpenShift Logging
• Multiple vulnerabilities in Red Hat OpenShift Enterprise Logging
• Multiple vulnerabilities in Red Hat OpenShift Enterprise Logging
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Spectrum Conductor
• Multiple vulnerabilities in IBM Netcool Agile Service Manager
• Code Injection in IBM Sterling Control Center
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Remote code execution in NSA Ghidra (Apache Log4j component)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Code Injection in IBM Spectrum Copy Data Management
• Code Injection in Oracle Communications Interactive Session Recorder
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Code Injection in Oracle Retail Fiscal Management
• Multiple vulnerabilities in Oracle Retail Assortment Planning
• Multiple vulnerabilities in Siebel UI Framework
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus
• Remote code execution in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift
• IBM Spectrum Protect Plus update for Apache Log4j
• IBM DB2 update for Apache Log4j
• Multiple vulnerabilities in Red Hat AMQ Streams 1.6
• Code injection in IBM Sterling Connect:Direct for UNIX (Apache Log4j component)
• Code injection in IBM Operations Dashboard (Apache Log4j component)
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base for IBM
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• JBoss Enterprise Application Platform 7.4 for RHEL 8 update for log4j
• JBoss Enterprise Application Platform 7.4 for RHEL 7 update for log4j
• Code Injection in Instantis EnterpriseTrack
• Multiple vulnerabilities in Oracle SQL Developer
• Code Injection in Enterprise Manager for Peoplesoft
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Code Injection in Oracle Communications Network Charging and Control
• Code Injection in Oracle Communications Convergent Charging Controller
• Code Injection in Oracle Communications Convergence
• Code Injection in Oracle Communications ASAP
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications IP Service Activator
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Code Injection in Oracle Communications WebRTC Session Controller
• Code Injection in Oracle Communications User Data Repository
• Code Injection in Oracle Communications Evolved Communications Application Server
• Code Injection in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Multiple vulnerabilities in Oracle Communications Performance Intelligence Center (PIC) Software
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Communications EAGLE FTP Table Base Retrieval
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Code Injection in Oracle Banking Party Management
• Code Injection in Oracle Banking Loans Servicing
• Code Injection in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in Oracle Banking Payments
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in Oracle Managed File Transfer
• Code Injection in Oracle Data Integrator
• Multiple vulnerabilities in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle JDeveloper
• Multiple vulnerabilities in Oracle Identity Manager Connector
• Multiple vulnerabilities in Oracle Identity Management Suite
• Code Injection in Oracle Health Sciences InForm
• Code Injection in Oracle Health Sciences Empirica Signal
• Multiple vulnerabilities in Oracle Healthcare Translational Research
• Code Injection in Oracle Healthcare Master Person Index
• Multiple vulnerabilities in Oracle Healthcare Data Repository
• Code Injection in Oracle Healthcare Foundation
• Multiple vulnerabilities in Oracle Health Sciences Information Manager
• Code Injection in Oracle Payment Interface
• Multiple vulnerabilities in Oracle Hospitality Suite8
• Multiple vulnerabilities in Oracle Hospitality Token Proxy Service
• Code Injection in Oracle Hyperion Tax Provision
• Multiple vulnerabilities in Hyperion Infrastructure Technology
• Multiple vulnerabilities in Hyperion Data Relationship Management
• Code Injection in Hyperion Profitability and Cost Management
• Code Injection in Hyperion Planning
• Code Injection in Hyperion Financial Management
• Code Injection in Oracle Hyperion BI+
• Code Injection in Oracle Insurance Insbridge Rating and Underwriting
• Code Injection in Oracle Insurance Data Gateway
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Code Injection in Oracle Retail Store Inventory Management
• Multiple vulnerabilities in Oracle Retail EFTLink
• Code Injection in Oracle Retail Data Extractor for Merchandising
• Code Injection in Oracle Retail Customer Insights
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Retail Financial Integration
• Code Injection in Oracle Autovue for Agile Product Lifecycle Management
• Code Injection in Oracle Agile PLM MCAD Connector
• Code Injection in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Code Injection in Oracle Utilities Framework
• Code Injection in Oracle Taleo Platform
• Code Injection in Oracle Enterprise Command Center Framework
• Code Injection in Oracle E-Business Suite Information Discovery
• Multiple vulnerabilities in IBM Telco Network Cloud Manager - Performance
• Multiple vulnerabilities in IBM Db2
• Code Injection in IBM Rational Software Architect RealTime Edition (RSA RT)
• Code Injection in IBM Event Streams
• Ubuntu update for apache-log4j2
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications Offline Mediation Controller
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Health Sciences Data Management Workbench
• Code Injection in Oracle Policy Automation for Mobile Devices
• Multiple vulnerabilities in Oracle Policy Automation
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Oracle Product Lifecycle Analytics
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Dell Data Protection Search
• Multiple vulnerabilities in Dell Unisphere Central
• Multiple vulnerabilities in Dell EMCRecoverPoint
• Remote code execution in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Oracle Essbase
• Multiple vulnerabilities in Oracle Communications MetaSolv Solution
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Order and Service Management
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Solaris Cluster
• IBM QRadar SIEM update for Apache Log4j
• Code Injection in Oracle Hospitality Labor Management
• Code Injection in Oracle Hospitality Gift and Loyalty
• Multiple vulnerabilities in Oracle Hospitality Reporting and Analytics
• Code Injection in Siebel Apps - Marketing
• Multiple vulnerabilities in Oracle Demantra Demand Management
• Multiple vulnerabilities in Dell Data Protection Search
• Multiple vulnerabilities in HPE Universal IoT (UIoT) Log4j
• Multiple vulnerabilities in HPE Network Functions
• Multiple vulnerabilities in HPE Fraud Risk Management Software Series
• Multiple vulnerabilities in HPE 3PAR Service Processors
• Multiple vulnerabilities in HPE enhanced Interactive Unified Mediation (eIUM)
• Multiple vulnerabilities in API Gateway and API Manager
• Axway SecureTransport update for Apache Log4j and OpenJDK JRE (January 2022)
• Code Injection in Oracle Retail Price Management
• Code Injection in Oracle Retail Invoice Matching
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in Juniper Networks Security Director Insights
• openEuler update for log4j,mybatis,netty,springframework,wildfly-security-manager,wildfly-elytron,wildfly-build-tools,wildfly-common,wildfly-core,thrift,json-lib,datanucleus-core,jgroups,mx4j,jboss-logging,infinispan,datanucleus-rdbms,avalon-logkit,datanu
• openEuler 20.03 LTS SP1 update for log4j
• openEuler 20.03 LTS SP3 update for log4j
• Multiple vulnerabilities in AMQ Streams 2.0
• Multiple vulnerabilities in JBoss Data Grid 8.2
• Fedora 35 update for log4j
• Fedora 34 update for log4j
• Multiple vulnerabilities in HPE 3PAR/Primera StoreServ Management Console (SSMC)
• Multiple vulnerabilities in HPE Aruba Silver Peak Orchestrator and Aruba IntroSpect
• Multiple vulnerabilities in IBM EntireX
• IBM webMethods BPM update for Apache Log4j2