https://bugzilla.redhat.com/show_bug.cgi?id=1785616
--- Comment #19 from Cedric Buissart 🐶 <cbuissar(a)redhat.com> ---
Statement:
This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar
flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned
CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux
via RHSA-2017:2423.
Also the rh-java-common-log4j package shipped with Red Hat Software Collections
was addressed via RHSA-2017:1417
In Satellite 5.8, although the version of log4j as shipped in the nutch package
is affected, nutch does not load any of the SocketServer classes from log4j.
Satellite 5 is considered not vulnerable to this flaw since the affected code
can not be reached.
--
You are receiving this mail because:
You are on the CC list for the bug.