An update for rh-maven36-log4j12 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-maven36-log4j12 security update Advisory ID: RHSA-2021:5269-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2021:5269 Issue date: 2021-12-22 CVE Names: CVE-2021-4104 ==================================================================== 1. Summary: An update for rh-maven36-log4j12 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fix(es): * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when applicationis configured to use JMSAppender 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-maven36-log4j12-1.2.17-23.3.el7.src.rpm noarch: rh-maven36-log4j12-1.2.17-23.3.el7.noarch.rpm rh-maven36-log4j12-javadoc-1.2.17-23.3.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-maven36-log4j12-1.2.17-23.3.el7.src.rpm noarch: rh-maven36-log4j12-1.2.17-23.3.el7.noarch.rpm rh-maven36-log4j12-javadoc-1.2.17-23.3.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-4104 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/vulnerabilities/RHSB-2021-009 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYcPVFNzjgjWX9erEAQj1CxAAmi/CMGm+T+ty3yyFytaRK8HswM5ybvgb 30gt/M9ie1xV1KWFlhkY8ytLftFzOH/EZU47T/USfW7WHzraJXVUxID4fbaiflcc sTaMDVHnMqMNvIkonUqjdvP4LA35gJ7Rm+mUs+iRPsLVTxV4QXiW7XUTB/Vb84tV YX2dEoN3aP6nFn6IsVgrpxu2qzx2gsUI5yJ1VvvsueHGqQfTF7xrfxCX4GhYgJNP /NvEXbvFrKOAe7x/QIFtPiSzptBlAIJOPmFHdCkdOp/1bXne196JidB+kGbNaVWv BwFI75p2nKdkqcD6+kNkwLllcYh/nZgUASCWFTSRlwKbHhEId/CV9BKqR7AOh382 8OOIGIiUZJRzMXrGUDTjwZCiNTHzCk5AO0CcMKngAXvQ7reS3PZ6IpwZ51XFkyAB R7Nf4VbxTWpDU49jj4nYd0V1UJIWcPJKOvqld7mT2B9YGzV7E1TS8djIabrOmQm0 4NkW4MiO6lxxkd+wKOe++c7AI24s30N6/vPW613h1CVfYqVwWkPN1XK+j/5EsKc0 wni66EyawHEZ+ldQ5Ck83Lj2ylodYoD2yxmMBS9FAp8CMeq+Vw4tP0Yh8CzJDXBs tbkUyO6FuhPXASi1ELwnX0UjWtPE6G4xxIvCOJ90ymeupBrCBj5d7rM/ADVhSDPL PZ3zWR/nc88=BG9f -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:14267-1 Rating: important References: #1159646 Cross-References: CVE-2019-17571 Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-log4j-14267=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-log4j-14267=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (noarch): log4j-1.2.15-26.32.14.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (noarch): log4j-1.2.15-26.32.14.1 References: https://www.suse.com/security/cve/CVE-2019-17571.html https://bugzilla.suse.com/1159646 _______________________________________________ sle-security-updates mailing list
Get the latest Linux and open source security news straight to your inbox.