[Bug 2031667] New: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Bug ID: 2031667 Summary: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: pjindal@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, asoldano@redhat.com, atangrin@redhat.com, avibelli@redhat.com, bbaranow@redhat.com, bdettelb@redhat.com, bgeorges@redhat.com, bibryam@redhat.com, bmaxwell@redhat.com, bmontgom@redhat.com, boliveir@redhat.com, brian.stansberry@redhat.com, caswilli@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, clement.escoffier@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dbecker@redhat.com, dbhole@redhat.com, devrim@gunduz.org, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, eleandro@redhat.com, eparis@redhat.com, etirelli@redhat.com, ewolinet@redhat.com, fjuma@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gsmet@redhat.com, hamadhan@redhat.com, hbraun@redhat.com, hhorak@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jcantril@redhat.com, jjoyce@redhat.com, jnethert@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jorton@redhat.com, jpallich@redhat.com, jperkins@redhat.com, jrokos@redhat.com, jross@redhat.com, jschluet@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, lgao@redhat.com, lhh@redhat.com, lpeer@redhat.com, lthon@redhat.com, mburns@redhat.com, mizdebsk@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msvehla@redhat.com, mszynkie@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pdelbell@redhat.com, pdrozd@redhat.com, peholase@redhat.com, pgallagh@redhat.com, pjindal@redhat.com, pmackay@redhat.com, probinso@redhat.com, rguimara@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, sbiarozk@redhat.com, sclewis@redhat.com, sd-operator-metering@redhat.com, sdouglas@redhat.com, sergio@serjux.com, slinaber@redhat.com, smaestri@redhat.com, sponnaga@redhat.com, sthorger@redhat.com, swoodman@redhat.com, tflannag@redhat.com, tom.jenkinson@redhat.com, tzimanyi@redhat.com, vkumar@redhat.com, yborgess@redhat.com Blocks: 2030930 Target Milestone: --- Classification: Other
A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender.
In 1.x you will find that there are two places where lookups are done - that is JMSAppender.java:207 and JMSAppender.java:222 - if you set TopicBindingName or TopicConnectionFactoryBindingName to something that JNDI can handle - for example "ldap://host:port/a" JNDI will do exactly the same thing it does for 2.x - so 1.x is vulnerable, just attack vector is "safer" as it depends on configuration rather than user input
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2021-4104 Summary|log4j: Remote code |CVE-2021-4104 log4j: Remote |execution in Log4j 1.x when |code execution in Log4j 1.x |application is configured |when application is |to use JMSAppender |configured to use | |JMSAppender
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2031675, 2031677, 2031676, | |2031674
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated
--- Comment #0 has been edited ---
A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender.
In 1.x you will find that there are two places where lookups are done - that is JMSAppender.java:207 and JMSAppender.java:222 - if you set TopicBindingName or TopicConnectionFactoryBindingName to something that JNDI can handle - for example "ldap://host:port/a" JNDI will do exactly the same thing it does for 2.x - so 1.x is vulnerable, just attack vector is "safer" as it depends on configuration rather than user input
This flaw in Log4j 2.x is tracked via CVE-2021-44228
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Doc Type|--- |If docs needed, set a value
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2031679
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2031679 [Bug 2031679] CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #3 from Huzaifa S. Sidhpurwala huzaifas@redhat.com --- Created log4j tracking bugs for this issue:
Affects: fedora-all [bug 2031679]
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Torstein Hansen torstein.hansen@statnett.no changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |torstein.hansen@statnett.no
--- Comment #5 from Torstein Hansen torstein.hansen@statnett.no --- https://github.com/apache/logging-log4j2/pull/608 Note that log4j 1.x is End of Life and has other security vulnerabilities that will not be fixed https://logging.apache.org/log4j/1.2/ https://www.cvedetails.com/cve/CVE-2019-17571/
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Doc Text *updated* by Huzaifa S. Sidhpurwala huzaifas@redhat.com --- A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x, The corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Lei Yu leiyu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |leiyu@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Doc Text *updated* by Przemyslaw Roguski proguski@redhat.com --- A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x, the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Grzegorz Grzybek ggrzybek@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ggrzybek@redhat.com Flags| |needinfo?(gmalinko@redhat.c | |om) | |needinfo?(aileenc@redhat.co | |m) | |needinfo?(ggaughan@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Yadnyawalk Tale ytale@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ytale@redhat.com
--- Comment #9 from Yadnyawalk Tale ytale@redhat.com --- Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it use logback framework for logging.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Jose Ortiz Padilla jortizpa@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jortizpa@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Rodrigo A B Freire rfreire@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |rfreire@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Bin Hu bihu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |bihu@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Simone simone.lucidi@outlook.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(pjindal@redhat.co | |m) CC| |simone.lucidi@outlook.com
--- Comment #14 from Simone simone.lucidi@outlook.com --- Hi there,
I don't understand how this vulnerability can be considered like the original one in 2.x.
1) you need to gain access to the log4j.properties file 2) you can execute a command only by putting it in the properties TopicBindingName or TopicConnectionFactoryBindingName. For example: log4j.appender.jms=org.apache.log4j.net.JMSAppender log4j.appender.jms.InitialContextFactoryName=org.apache.activemq.jndi.ActiveMQInitialContextFactory log4j.appender.jms.ProviderURL=tcp://localhost:61616
log4j.appender.jms.TopicBindingName=ldap://host:port/a log4j.appender.jms.TopicConnectionFactoryBindingName=ldap://host:port/a
So it's not input-driven like the CVE-2021-44228. In a situation like this, I don't understand how an attacker can (as written in the title) do a "Remote code execution". In the worst scenario it can be a "local code execution" after he already gained server access...am I wrong? Thank you!
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Yadnyawalk Tale ytale@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|9 |updated
--- Comment #9 has been edited ---
Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it does not make use of JMSAppender method and use logback framework for logging.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Daniel Chong dchong@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dchong@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032100, 2032101
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032102
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Doc Text *updated* by Paramvir jindal pjindal@redhat.com --- A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JMS Broker. Note this flaw only affects when specifically configured to use JMSAppender, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSAppender to the attacker's JMS Broker. If it is set TopicBindingName or TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228 Log4j 2.x, Log4j 1.x is vulnerable, however, the attack vector is "safer" as it depends on configuration rather than user input. These are sufficient factors beyond the attacker's control. Based on the conditions to be exploitable, the risk is much lower than Log4j 2.x. This flaw has been filed for Log4j 1.x, the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #23 from Paramvir jindal pjindal@redhat.com --- In reply to comment #14:
Hi there,
I don't understand how this vulnerability can be considered like the original one in 2.x.
- you need to gain access to the log4j.properties file
- you can execute a command only by putting it in the properties
TopicBindingName or TopicConnectionFactoryBindingName. For example: log4j.appender.jms=org.apache.log4j.net.JMSAppender log4j.appender.jms.InitialContextFactoryName=org.apache.activemq.jndi. ActiveMQInitialContextFactory log4j.appender.jms.ProviderURL=tcp://localhost:61616
log4j.appender.jms.TopicBindingName=ldap://host:port/a log4j.appender.jms.TopicConnectionFactoryBindingName=ldap://host:port/a
So it's not input-driven like the CVE-2021-44228. In a situation like this, I don't understand how an attacker can (as written in the title) do a "Remote code execution". In the worst scenario it can be a "local code execution" after he already gained server access...am I wrong? Thank you!
that is correct. I have updated the CVE description just now to include as much details as possible regarding the conditions required to exploit the flaw.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Doc Text *updated* by Paramvir jindal pjindal@redhat.com --- A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JMS Broker.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #24 from Paramvir jindal pjindal@redhat.com --- Marking Red Hat EAP-XP 3 as not affected; the product does not directly ship log4j, but consumes artifacts from base EAP.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #25 from Paramvir jindal pjindal@redhat.com --- Marking JDG-8 as not affected as it does not ship log4j version 1 anywhere with its distribution.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032153, 2032151, 2032156, | |2032157, 2032161, 2032164, | |2032158, 2032152, 2032162, | |2032163, 2032159, 2032160, | |2032155, 2032154
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032166
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032166
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032182, 2032181
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032185
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #32 from Simone simone.lucidi@outlook.com --- (In reply to Paramvir jindal from comment #23)
In reply to comment #14:
Hi there,
I don't understand how this vulnerability can be considered like the original one in 2.x.
- you need to gain access to the log4j.properties file
- you can execute a command only by putting it in the properties
TopicBindingName or TopicConnectionFactoryBindingName. For example: log4j.appender.jms=org.apache.log4j.net.JMSAppender log4j.appender.jms.InitialContextFactoryName=org.apache.activemq.jndi. ActiveMQInitialContextFactory log4j.appender.jms.ProviderURL=tcp://localhost:61616
log4j.appender.jms.TopicBindingName=ldap://host:port/a log4j.appender.jms.TopicConnectionFactoryBindingName=ldap://host:port/a
So it's not input-driven like the CVE-2021-44228. In a situation like this, I don't understand how an attacker can (as written in the title) do a "Remote code execution". In the worst scenario it can be a "local code execution" after he already gained server access...am I wrong? Thank you!
that is correct. I have updated the CVE description just now to include as much details as possible regarding the conditions required to exploit the flaw.
Thank you Paramvir! In this case, the only real solution would be to give proper read/write permission to our application files, right? If I simply update my log4j to the latest fixed version (2.15), I would still be vulnerable, since an attacker that has gained access to my server can also replace my log4j jar with a previous version. what do you think? Thanks again!
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #41 from Ugo Bellavance ubellavance@atq.qc.ca --- Please add status for Red Hat Enterprise Linux 6, which is still covered by ELS. Thanks,
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2032312, 2032322, 2032313, | |2032309, 2032318, 2032310, | |2032320, 2032314, 2032319, | |2032316, 2032321, 2032317, | |2032323, 2032311, 2032315
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Mark Little mlittle@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mlittle@redhat.com
--- Comment #43 from Mark Little mlittle@redhat.com --- I agree with Carlo de Wolf and others: there is no log4j v2 exploit here. Other vendors, such as Apache, Snyk, Microsoft, Atlassian etc. have reviewed log4j v1 too, specifically with the JMSAppender concern. Including a couple of references:
https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html
"We have done additional analysis on this fork and confirmed a new but similar vulnerability that can only be exploited by a trusted party. For that reason, Atlassian rates the severity level for on-premises products as low. Specifically, Atlassian products that use Log4j 1.x are only affected if all of the following non-default configurations are in place:
The JMS Appender is configured in the application's Log4j configuration The javax.jms API is included in the application's CLASSPATH The JMS Appender has been configured with a JNDI lookup to a third party. Note: this can only be done by a trusted user modifying the application's configuration, or by trusted code setting a property at runtime "
And https://lists.apache.org/thread/lgbtvvmy68p0059yoyn9qxzosdmx4jdv
"1. As *log4j 1.x* does NOT offer a JNDI look up mechanism at the message level,* it does NOT suffer from CVE-2021-44228.* 2. However, log4j 1.x comes with JMSAppender which will perform JNDI lookup if enabled in log4j's configuration file, i.e. *log4j.properties* or *log4j.xml*. 3. In the absense of a new log4j 1.x release, you can remove JMSAppender from *log4j-1.2.17.jar* artifact yourself. (commands are listed in the page http://slf4j.org/log4shell.html) 4. Therefore, in addition to hardening KNOWN vulnerable components in aforementioned frameworks, we also recommend that *configuration files be protected against write access*. In Unix-speak they should be *read-only for all users, including the owner*. If possible, they should also be monitored against changes and unauthorized manipulation."
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Torsten Mielke tmielke@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |security-response-team@redh | |at.com, tmielke@redhat.com Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Mike Murphy micmurph@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |micmurph@redhat.com
--- Comment #50 from Mike Murphy micmurph@redhat.com --- Can we confirm whether or not we'll provide an update for verion 1.x ? Specifically 1.2.17? Or will this be considered not affected?
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #51 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.8
Via RHSA-2021:5148 https://access.redhat.com/errata/RHSA-2021:5148
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5148
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Courtney Ruhm cruhm@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |cruhm@redhat.com Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Kaushal Sathe ksathe@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ksathe@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #55 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5141 https://access.redhat.com/errata/RHSA-2021:5141
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5141
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Torsten Mielke tmielke@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #57 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.7
Via RHSA-2021:5107 https://access.redhat.com/errata/RHSA-2021:5107
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5107
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #58 from Ted Jongseok Won jwon@redhat.com --- In reply to comment #50:
Can we confirm whether or not we'll provide an update for verion 1.x ? Specifically 1.2.17? Or will this be considered not affected?
Providing or using a patched log4j 1.x version is at the discretion of the particular affected product's team.
Note: This is a moderate impact CVE and may be out of support scope for some products listed, these are detailed on our life-cycle pages - https://access.redhat.com/support/policy/updates/jboss_notes/
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) | |needinfo?(jwon@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Courtney Ruhm cruhm@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(security-response | |-team@redhat.com)
--- Comment #59 from Courtney Ruhm cruhm@redhat.com --- Hello,
Has then been any indication on what engineering is doing in regards to the log4j image being present in hawkular. A customer is getting very heated that there has been no indication of why were not addressing it.is there any plan to add it to the CVE and what were going to do to address it? If we can get a clear answer or proof that the CVE is not affecting hawkular despite the image being present. That would go a long way.
The logjv 1.2 image is present in hawkular
https://github.com/hawkular/hawkular-metrics/blob/master/pom.xml
<dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>${version.org.slf4j}</version>
Thank you
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(jwon@redhat.com) |-team@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Courtney Ruhm cruhm@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(cruhm@redhat.com) |needinfo?(rfreire@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Courtney Ruhm cruhm@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(rfreire@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Rodrigo A B Freire rfreire@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(rfreire@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #65 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.8
Via RHSA-2021:5183 https://access.redhat.com/errata/RHSA-2021:5183
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5183
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #66 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.7
Via RHSA-2021:5184 https://access.redhat.com/errata/RHSA-2021:5184
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5184
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #67 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5186 https://access.redhat.com/errata/RHSA-2021:5186
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5186
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Stoyan Nikolov snikolov@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2033534
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #69 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Extended Lifecycle Support Red Hat Enterprise Linux 7.3 Advanced Update Support Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Red Hat Enterprise Linux 7.7 Advanced Update Support Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Red Hat Enterprise Linux 7.7 Telco Extended Update Support Red Hat Enterprise Linux 7
Via RHSA-2021:5206 https://access.redhat.com/errata/RHSA-2021:5206
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5206
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) | |needinfo?(jwon@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Filip Brychta fbrychta@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |fbrychta@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(pjindal@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #72 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7
Via RHSA-2021:5269 https://access.redhat.com/errata/RHSA-2021:5269
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5269
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #73 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-4104
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-12-22 22:10:56
https://bugzilla.redhat.com/show_bug.cgi?id=2031667 Bug 2031667 depends on bug 2031679, which changed state.
Bug 2031679 Summary: CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2031679
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Doc Text *updated* by Ted Jongseok Won jwon@redhat.com --- A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JNDI LDAP endpoint.
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
Aileen aileenc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(aileenc@redhat.co |needinfo- |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #83 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Via RHSA-2022:0294 https://access.redhat.com/errata/RHSA-2022:0294
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0294
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #84 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2022:0290 https://access.redhat.com/errata/RHSA-2022:0290
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0290
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #85 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.2 Extended Update Support
Via RHSA-2022:0291 https://access.redhat.com/errata/RHSA-2022:0291
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0291
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #86 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.4 Extended Update Support
Via RHSA-2022:0289 https://access.redhat.com/errata/RHSA-2022:0289
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0289
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #87 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 7.3.9
Via RHSA-2022:0430 https://access.redhat.com/errata/RHSA-2022:0430
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0430
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #88 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.4 log4j async
Via RHSA-2022:0435 https://access.redhat.com/errata/RHSA-2022:0435
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0435
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #89 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2022:0436 https://access.redhat.com/errata/RHSA-2022:0436
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0436
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #90 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 6.4 log4j async
Via RHSA-2022:0437 https://access.redhat.com/errata/RHSA-2022:0437
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0437
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #91 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
Via RHSA-2022:0438 https://access.redhat.com/errata/RHSA-2022:0438
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0438
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #92 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL-8 based Middleware Containers
Via RHSA-2022:0444 https://access.redhat.com/errata/RHSA-2022:0444
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0444
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #93 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.4.10
Via RHSA-2022:0446 https://access.redhat.com/errata/RHSA-2022:0446
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0446
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #94 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHSSO 7.5.1
Via RHSA-2022:0449 https://access.redhat.com/errata/RHSA-2022:0449
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0449
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #96 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.5 for RHEL 8
Via RHSA-2022:0448 https://access.redhat.com/errata/RHSA-2022:0448
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0448
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #97 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.5 for RHEL 7
Via RHSA-2022:0447 https://access.redhat.com/errata/RHSA-2022:0447
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0447
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #98 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL-8 based Middleware Containers
Via RHSA-2022:0445 https://access.redhat.com/errata/RHSA-2022:0445
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0445
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #99 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL-8 based Middleware Containers
Via RHSA-2022:0450 https://access.redhat.com/errata/RHSA-2022:0450
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0450
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #100 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Virtualization Engine 4.4
Via RHSA-2022:0475 https://access.redhat.com/errata/RHSA-2022:0475
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0475
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #101 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Data Virtualization 6.4.8.SP1
Via RHSA-2022:0497 https://access.redhat.com/errata/RHSA-2022:0497
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0497
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #102 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Data Virtualization 6.4.8.SP2
Via RHSA-2022:0507 https://access.redhat.com/errata/RHSA-2022:0507
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0507
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #103 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server 3 for RHEL 7
Via RHSA-2022:0524 https://access.redhat.com/errata/RHSA-2022:0524
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0524
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #104 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server
Via RHSA-2022:0527 https://access.redhat.com/errata/RHSA-2022:0527
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0527
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #105 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse/AMQ 6.3.20
Via RHSA-2022:0553 https://access.redhat.com/errata/RHSA-2022:0553
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0553
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #106 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.10.1
Via RHSA-2022:0661 https://access.redhat.com/errata/RHSA-2022:0661
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0661
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #107 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2022:1296 https://access.redhat.com/errata/RHSA-2022:1296
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1296
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #108 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2022:1297 https://access.redhat.com/errata/RHSA-2022:1297
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1297
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #109 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 7.4.4 release
Via RHSA-2022:1299 https://access.redhat.com/errata/RHSA-2022:1299
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1299
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #113 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP 6.4.24 release
Via RHSA-2022:5458 https://access.redhat.com/errata/RHSA-2022:5458
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5458
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #114 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2022:5459 https://access.redhat.com/errata/RHSA-2022:5459
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5459
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #115 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
Via RHSA-2022:5460 https://access.redhat.com/errata/RHSA-2022:5460
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5460
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #117 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:5856
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
--- Comment #118 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
Via RHSA-2024:10207 https://access.redhat.com/errata/RHSA-2024:10207
https://bugzilla.redhat.com/show_bug.cgi?id=2031667
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:10207
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com