RHSA-2022:0497HighCVSS 9.8
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4.8.SP1 security update
🔗 CVE IDs covered (6)
📋 Description
CVE-2019-17571 — log4j: deserialization of untrusted data in SocketServer CVE-2020-9488 — log4j: improper validation of certificate with host mismatch in SMTP appender CVE-2021-4104 — log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender CVE-2022-23302 — log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink CVE-2022-23305 — log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23307 — log4j: Unsafe deserialization flaw in Chainsaw log viewer
🔗 References (11)
- selfhttps://access.redhat.com/errata/RHSA-2022:0497
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform&downloadType=securityPatches&version=6.4
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_data_virtualization/6.4/html/release_notes/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1785616
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1831139
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2031667
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041949
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041959
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2041967
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0497.json