Vulnerability · Published Jan 18, 2022 · Assigned by apache
CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
High 8.8
In plain English
A high-severity unsafe deserialization in Apache Log4j 1.x from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 54.4% (higher than 99.0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)54.4%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | parfait | 0.5.4-4.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | parfait | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | parfait-examples | 0.5.4-4.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | parfait-examples | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | parfait-javadoc | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | parfait-javadoc | 0.5.4-4.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | pcp-parfait-agent | 0.5.4-4.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | pcp-parfait-agent | 0.5.4-4.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | si-units | 0.6.5-2.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | si-units | 0.6.5-2.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | si-units-javadoc | 0.6.5-2.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | si-units-javadoc | 0.6.5-2.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | unit-api | 1.0-5.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | unit-api | 1.0-5.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | unit-api-javadoc | 1.0-5.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | unit-api-javadoc | 1.0-5.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-lib | 1.0.1-6.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-lib | 1.0.1-6.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-lib-javadoc | 1.0.1-6.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-lib-javadoc | 1.0.1-6.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-parent | 1.0.3-3.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-parent | 1.0.3-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-se | 1.0.4-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-se | 1.0.4-3.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-se-javadoc | 1.0.4-3.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-se-javadoc | 1.0.4-3.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-systems | 0.7-1.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| AlmaLinux:8 | uom-systems | 0.7-1.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-systems-javadoc | 0.7-1.module_el8.5.0+2610+de2b8c0b | ALSA-2022:0290 |
| AlmaLinux:8 | uom-systems-javadoc | 0.7-1.module_el8.5.0+235+62ea7738 | ALSA-2022:0290 |
| Debian:12 | apache-log4j1.2 | 1.2.17-11 | DEBIAN-CVE-2022-23307 |
| Debian:13 | apache-log4j1.2 | 1.2.17-11 | DEBIAN-CVE-2022-23307 |
| Debian:14 | apache-log4j1.2 | 1.2.17-11 | DEBIAN-CVE-2022-23307 |
| Maven | log4j:log4j | no fix listed | GHSA-f7vh-qwp3-x37m |
| Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | no fix listed | GHSA-f7vh-qwp3-x37m |
| Rocky Linux:8 | parfait | 0:0.5.4-4.module+el8.5.0+728+553fbdb8 | RLSA-2022:0290 |
| Rocky Linux:8 | si-units | 0:0.6.5-2.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux:8 | unit-api | 0:1.0-5.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux:8 | uom-lib | 0:1.0.1-6.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux:8 | uom-parent | 0:1.0.3-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux:8 | uom-se | 0:1.0.4-3.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
| Rocky Linux:8 | uom-systems | 0:0.7-1.module+el8.3.0+214+edf13b3f | RLSA-2022:0290 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Log4j 1.x | 1.2.1 – before unspecifiedunspecified – through 2.0-alpha1 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://logging.apache.org/log4j/1.2/index.html x_refsource_MISC
- https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC