https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bug ID: 1443635 Summary: CVE-2017-5645 log4j: Socket receiver deserialization vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, aortega@redhat.com, apevec@redhat.com, avibelli@redhat.com, ayoung@redhat.com, bkearney@redhat.com, bmcclain@redhat.com, cbillett@redhat.com, chazlett@redhat.com, chrisw@redhat.com, coneill@redhat.com, csutherl@redhat.com, cvsbot-xmlrpc@redhat.com, dandread@redhat.com, dblechte@redhat.com, devrim@gunduz.org, dwalluck@redhat.com, eedri@redhat.com, etirelli@redhat.com, gklein@redhat.com, gsterlin@redhat.com, gvarsami@redhat.com, gzaronik@redhat.com, hhorak@redhat.com, huwang@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jbalunas@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jjoyce@redhat.com, jorton@redhat.com, jschluet@redhat.com, jshepherd@redhat.com, kbasil@redhat.com, kconner@redhat.com, kseifried@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, lhh@redhat.com, lpeer@redhat.com, lpetrovi@redhat.com, lsurette@redhat.com, markmc@redhat.com, mbabacek@redhat.com, mbaluch@redhat.com, meissner@suse.de, mgoldboi@redhat.com, michal.skrivanek@redhat.com, mizdebsk@redhat.com, msimacek@redhat.com, mwinkler@redhat.com, myarboro@redhat.com, nwallace@redhat.com, pavelp@redhat.com, rbalakri@redhat.com, rbryant@redhat.com, Rhev-m-bugs@redhat.com, rrajasek@redhat.com, rwagner@redhat.com, rzhang@redhat.com, sclewis@redhat.com, sherold@redhat.com, spinder@redhat.com, srevivo@redhat.com, taw@redhat.com, tcunning@redhat.com, tdecacqu@redhat.com, theute@redhat.com, thomas@suse.de, tjay@redhat.com, tkirby@redhat.com, tlestach@redhat.com, tomckay@redhat.com, twalsh@redhat.com, weli@redhat.com, ydary@redhat.com, ykaul@redhat.com
When using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
References:
http://seclists.org/oss-sec/2017/q2/78
Upstream bug:
https://issues.apache.org/jira/browse/LOG4J2-1863
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |log4j 2.8.2
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1443637
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Created log4j tracking bugs for this issue:
Affects: fedora-all [bug 1443637]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1443637 [Bug 1443637] CVE-2017-5645 log4j: Socket receiver deserialization vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1443639 Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=new,bpms-6/lo |d,amq-6/log4j=new,bpms-6/lo |g4j=new,brms-6/log4j=new,ea |g4j=notaffected,brms-6/log4 |p-5/log4j=new,brms-5/log4j= |j=new,eap-5/log4j=new,brms- |new,fsw-6/log4j=new,fuse-6/ |5/log4j=new,fsw-6/log4j=not |log4j=new,jon-3/log4j=new,r |affected,fuse-6/log4j=notaf |hev-m-3/jasperreports-serve |fected,jon-3/log4j=new,rhev |r-pro=new,rhn_satellite_5/n |-m-3/jasperreports-server-p |utch=new,openstack-7-optool |ro=new,rhn_satellite_5/nutc |s/log4j=new,rhmap-4/log4j=n |h=notaffected,openstack-7-o |ew,rhel-5/log4j=new,rhel-6/ |ptools/log4j=notaffected,rh |log4j=new,rhel-7/log4j=new, |map-4/log4j=new,rhel-5/log4 |jbews-3/log4j-log4j=new,sam |j=new,rhel-6/log4j=new,rhel |-1/log4j=new,rhscl-2/rh-jav |-7/log4j=new,jbews-3/log4j- |a-common-log4j=new |log4j=new,sam-1/log4j=notaf | |fected,rhscl-2/rh-java-comm | |on-log4j=notaffected,jdg-6/ | |log4j-core=new
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=new,bpms-6/lo |d,amq-6/log4j=new,bpms-6/lo |g4j=notaffected,brms-6/log4 |g4j=notaffected,brms-6/log4 |j=new,eap-5/log4j=new,brms- |j=new,eap-5/log4j=new,brms- |5/log4j=new,fsw-6/log4j=not |5/log4j=new,fsw-6/log4j=aff |affected,fuse-6/log4j=notaf |ected,fuse-6/log4j=affected |fected,jon-3/log4j=new,rhev |,jon-3/log4j=new,rhev-m-3/j |-m-3/jasperreports-server-p |asperreports-server-pro=new |ro=new,rhn_satellite_5/nutc |,rhn_satellite_5/nutch=nota |h=notaffected,openstack-7-o |ffected,openstack-7-optools |ptools/log4j=notaffected,rh |/log4j=notaffected,rhmap-4/ |map-4/log4j=new,rhel-5/log4 |log4j=new,rhel-5/log4j=new, |j=new,rhel-6/log4j=new,rhel |rhel-6/log4j=new,rhel-7/log |-7/log4j=new,jbews-3/log4j- |4j=new,jbews-3/log4j-log4j= |log4j=new,sam-1/log4j=notaf |new,sam-1/log4j=notaffected |fected,rhscl-2/rh-java-comm |,rhscl-2/rh-java-common-log |on-log4j=notaffected,jdg-6/ |4j=notaffected,jdg-6/log4j- |log4j-core=new |core=new
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=new,bpms-6/lo |d,amq-6/log4j=affected,bpms |g4j=notaffected,brms-6/log4 |-6/log4j=notaffected,brms-6 |j=new,eap-5/log4j=new,brms- |/log4j=new,eap-5/log4j=new, |5/log4j=new,fsw-6/log4j=aff |brms-5/log4j=new,fsw-6/log4 |ected,fuse-6/log4j=affected |j=affected,fuse-6/log4j=aff |,jon-3/log4j=new,rhev-m-3/j |ected,jon-3/log4j=new,rhev- |asperreports-server-pro=new |m-3/jasperreports-server-pr |,rhn_satellite_5/nutch=nota |o=new,rhn_satellite_5/nutch |ffected,openstack-7-optools |=notaffected,openstack-7-op |/log4j=notaffected,rhmap-4/ |tools/log4j=notaffected,rhm |log4j=new,rhel-5/log4j=new, |ap-4/log4j=new,rhel-5/log4j |rhel-6/log4j=new,rhel-7/log |=new,rhel-6/log4j=new,rhel- |4j=new,jbews-3/log4j-log4j= |7/log4j=new,jbews-3/log4j-l |new,sam-1/log4j=notaffected |og4j=new,sam-1/log4j=notaff |,rhscl-2/rh-java-common-log |ected,rhscl-2/rh-java-commo |4j=notaffected,jdg-6/log4j- |n-log4j=notaffected,jdg-6/l |core=new |og4j-core=new
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=notaffected,brms-6 |-6/log4j=affected,brms-6/lo |/log4j=new,eap-5/log4j=new, |g4j=affected,eap-5/log4j=ne |brms-5/log4j=new,fsw-6/log4 |w,brms-5/log4j=wontfix,fsw- |j=affected,fuse-6/log4j=aff |6/log4j=wontfix,fuse-6/log4 |ected,jon-3/log4j=new,rhev- |j=affected,jon-3/log4j=new, |m-3/jasperreports-server-pr |rhev-m-3/jasperreports-serv |o=new,rhn_satellite_5/nutch |er-pro=new,rhn_satellite_5/ |=notaffected,openstack-7-op |nutch=notaffected,openstack |tools/log4j=notaffected,rhm |-7-optools/log4j=notaffecte |ap-4/log4j=new,rhel-5/log4j |d,rhmap-4/log4j=new,rhel-5/ |=new,rhel-6/log4j=new,rhel- |log4j=new,rhel-6/log4j=new, |7/log4j=new,jbews-3/log4j-l |rhel-7/log4j=new,jbews-3/lo |og4j=new,sam-1/log4j=notaff |g4j-log4j=new,sam-1/log4j=n |ected,rhscl-2/rh-java-commo |otaffected,rhscl-2/rh-java- |n-log4j=notaffected,jdg-6/l |common-log4j=notaffected,jd |og4j-core=new |g-6/log4j-core=new,soap-5/l | |og4j=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #4 from Hooman Broujerdi hghasemb@redhat.com --- JBoss fuse ships log4j in, karaf/pax logging, cxf, fabric8, activemq and hawtio components.
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=new,rhev-m-3/jasperrepo |g4j=notaffected,rhev-m-3/ja |rts-server-pro=new,rhn_sate |sperreports-server-pro=new, |llite_5/nutch=notaffected,o |rhn_satellite_5/nutch=notaf |penstack-7-optools/log4j=no |fected,openstack-7-optools/ |taffected,rhmap-4/log4j=new |log4j=notaffected,rhmap-4/l |,rhel-5/log4j=new,rhel-6/lo |og4j=new,rhel-5/log4j=new,r |g4j=new,rhel-7/log4j=new,jb |hel-6/log4j=new,rhel-7/log4 |ews-3/log4j-log4j=new,sam-1 |j=new,jbews-3/log4j-log4j=n |/log4j=notaffected,rhscl-2/ |ew,sam-1/log4j=notaffected, |rh-java-common-log4j=notaff |rhscl-2/rh-java-common-log4 |ected,jdg-6/log4j-core=new, |j=notaffected,jdg-6/log4j-c |soap-5/log4j=wontfix |ore=new,soap-5/log4j=wontfi | |x
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=ne |g4j=affected,eap-5/log4j=no |w,brms-5/log4j=wontfix,fsw- |taffected,brms-5/log4j=wont |6/log4j=wontfix,fuse-6/log4 |fix,fsw-6/log4j=wontfix,fus |j=affected,jon-3/log4j=new, |e-6/log4j=affected,jon-3/lo |rhev-m-3/jasperreports-serv |g4j=new,rhev-m-3/jasperrepo |er-pro=new,rhn_satellite_5/ |rts-server-pro=new,rhn_sate |nutch=notaffected,openstack |llite_5/nutch=notaffected,o |-7-optools/log4j=notaffecte |penstack-7-optools/log4j=no |d,rhmap-4/log4j=new,rhel-5/ |taffected,rhmap-4/log4j=new |log4j=new,rhel-6/log4j=new, |,rhel-5/log4j=new,rhel-6/lo |rhel-7/log4j=new,jbews-3/lo |g4j=new,rhel-7/log4j=new,jb |g4j-log4j=new,sam-1/log4j=n |ews-3/log4j-log4j=new,sam-1 |otaffected,rhscl-2/rh-java- |/log4j=notaffected,rhscl-2/ |common-log4j=notaffected,jd |rh-java-common-log4j=notaff |g-6/log4j-core=new,soap-5/l |ected,jdg-6/log4j-core=new, |og4j=wontfix |soap-5/log4j=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #5 from Jason Shepherd jshepherd@redhat.com --- Both EAP 5 and JON3 don't have the affect Tcp and Udp SockerServer classes
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Apurbita Mukherjee apmukher@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |apmukher@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=new,rhel-5/log4j=new,r |og4j=new,rhel-5/log4j=new,r |hel-6/log4j=new,rhel-7/log4 |hel-6/log4j=new,rhel-7/log4 |j=new,jbews-3/log4j-log4j=n |j=new,sam-1/log4j=notaffect |ew,sam-1/log4j=notaffected, |ed,rhscl-2/rh-java-common-l |rhscl-2/rh-java-common-log4 |og4j=notaffected,jdg-6/log4 |j=notaffected,jdg-6/log4j-c |j-core=new,soap-5/log4j=won |ore=new,soap-5/log4j=wontfi |tfix,jws-3/log4j=notaffecte |x |d
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1443635 Bug 1443635 depends on bug 1443637, which changed state.
Bug 1443637 Summary: CVE-2017-5645 log4j: Socket receiver deserialization vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1443637
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #7 from Jason Shepherd jshepherd@redhat.com --- For Log4j 1.2.x SocketServer class needs to be used. It's probably easier to check of use of client configuration in logging.properties, or xml files. It would look something like this:
log4j.appender.server=org.apache.log4j.net.SocketAppender log4j.appender.server.Port=4712 log4j.appender.server.RemoteHost=localhost
Ref: http://howtodoinjava.com/log4j/log4j-socketappender-and-socket-server-exampl...
Doesn't seem to be used by RHMAP, marking as notaffected.
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=new,rhel-5/log4j=new,r |og4j=notaffected,rhel-5/log |hel-6/log4j=new,rhel-7/log4 |4j=new,rhel-6/log4j=new,rhe |j=new,sam-1/log4j=notaffect |l-7/log4j=new,sam-1/log4j=n |ed,rhscl-2/rh-java-common-l |otaffected,rhscl-2/rh-java- |og4j=notaffected,jdg-6/log4 |common-log4j=notaffected,jd |j-core=new,soap-5/log4j=won |g-6/log4j-core=new,soap-5/l |tfix,jws-3/log4j=notaffecte |og4j=wontfix,jws-3/log4j=no |d |taffected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |puntogil@libero.it Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=new,rhel-6/log4j=new,rhe |4j=new,rhel-6/log4j=new,rhe |l-7/log4j=new,sam-1/log4j=n |l-7/log4j=new,sam-1/log4j=n |otaffected,rhscl-2/rh-java- |otaffected,rhscl-2/rh-java- |common-log4j=notaffected,jd |common-log4j=notaffected,jd |g-6/log4j-core=new,soap-5/l |g-6/log4j-core=new,soap-5/l |og4j=wontfix,jws-3/log4j=no |og4j=wontfix,jws-3/log4j=no |taffected |taffected,fedora-all/log4j1 | |2=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1457722
--- Comment #8 from Cedric Buissart cbuissar@redhat.com --- Created log4j12 tracking bugs for this issue:
Affects: fedora-all [bug 1457722]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1457722 [Bug 1457722] CVE-2017-5645 log4j12: log4j: Socket receiver deserialization vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=new,rhel-6/log4j=new,rhe |4j=new,rhel-6/log4j=new,rhe |l-7/log4j=new,sam-1/log4j=n |l-7/log4j=affected,sam-1/lo |otaffected,rhscl-2/rh-java- |g4j=notaffected,rhscl-2/rh- |common-log4j=notaffected,jd |java-common-log4j=notaffect |g-6/log4j-core=new,soap-5/l |ed,jdg-6/log4j-core=new,soa |og4j=wontfix,jws-3/log4j=no |p-5/log4j=wontfix,jws-3/log |taffected,fedora-all/log4j1 |4j=notaffected,fedora-all/l |2=affected |og4j12=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=new,rhel-6/log4j=new,rhe |4j=new,rhel-6/log4j=new,rhe |l-7/log4j=affected,sam-1/lo |l-7/log4j=affected,sam-1/lo |g4j=notaffected,rhscl-2/rh- |g4j=notaffected,rhscl-2/rh- |java-common-log4j=notaffect |java-common-log4j=affected, |ed,jdg-6/log4j-core=new,soa |jdg-6/log4j-core=new,soap-5 |p-5/log4j=wontfix,jws-3/log |/log4j=wontfix,jws-3/log4j= |4j=notaffected,fedora-all/l |notaffected,fedora-all/log4 |og4j12=affected |j12=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1457756, 1457757
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=new,rhel-6/log4j=new,rhe |4j=wontfix,rhel-6/log4j=new |l-7/log4j=affected,sam-1/lo |,rhel-7/log4j=affected,sam- |g4j=notaffected,rhscl-2/rh- |1/log4j=notaffected,rhscl-2 |java-common-log4j=affected, |/rh-java-common-log4j=affec |jdg-6/log4j-core=new,soap-5 |ted,jdg-6/log4j-core=new,so |/log4j=wontfix,jws-3/log4j= |ap-5/log4j=wontfix,jws-3/lo |notaffected,fedora-all/log4 |g4j=notaffected,fedora-all/ |j12=affected |log4j12=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=wontfix,rhel-6/log4j=new |4j=wontfix,rhel-6/log4j=won |,rhel-7/log4j=affected,sam- |tfix,rhel-7/log4j=affected, |1/log4j=notaffected,rhscl-2 |sam-1/log4j=notaffected,rhs |/rh-java-common-log4j=affec |cl-2/rh-java-common-log4j=a |ted,jdg-6/log4j-core=new,so |ffected,jdg-6/log4j-core=ne |ap-5/log4j=wontfix,jws-3/lo |w,soap-5/log4j=wontfix,jws- |g4j=notaffected,fedora-all/ |3/log4j=notaffected,fedora- |log4j12=affected |all/log4j12=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Doc Text *updated* by Cedric Buissart cbuissar@redhat.com --- It was found that when using remote logging with log4j socket server, the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
Via RHSA-2017:1417 https://access.redhat.com/errata/RHSA-2017:1417
https://bugzilla.redhat.com/show_bug.cgi?id=1443635 Bug 1443635 depends on bug 1457722, which changed state.
Bug 1457722 Summary: CVE-2017-5645 log4j12: log4j: Socket receiver deserialization vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1457722
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1467261, 1467262
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |apintea@redhat.com, | |bkundal@redhat.com, | |bmaxwell@redhat.com, | |cdewolf@redhat.com, | |darran.lofthouse@redhat.com | |, dimitris@redhat.com, | |dosoudil@redhat.com, | |fgavrilo@redhat.com, | |jawilson@redhat.com, | |jondruse@redhat.com, | |pgier@redhat.com, | |pjurak@redhat.com, | |ppalaga@redhat.com, | |psakar@redhat.com, | |pslavice@redhat.com, | |rnetuka@redhat.com, | |rstancel@redhat.com, | |rsvoboda@redhat.com, | |sstavrev@redhat.com, | |vtunka@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=no |taffected,brms-5/log4j=wont |taffected,brms-5/log4j=wont |fix,fsw-6/log4j=wontfix,fus |fix,fsw-6/log4j=wontfix,fus |e-6/log4j=affected,jon-3/lo |e-6/log4j=affected,jon-3/lo |g4j=notaffected,rhev-m-3/ja |g4j=notaffected,rhev-m-3/ja |sperreports-server-pro=new, |sperreports-server-pro=new, |rhn_satellite_5/nutch=notaf |rhn_satellite_5/nutch=notaf |fected,openstack-7-optools/ |fected,openstack-7-optools/ |log4j=notaffected,rhmap-4/l |log4j=notaffected,rhmap-4/l |og4j=notaffected,rhel-5/log |og4j=notaffected,rhel-5/log |4j=wontfix,rhel-6/log4j=won |4j=wontfix,rhel-6/log4j=won |tfix,rhel-7/log4j=affected, |tfix,rhel-7/log4j=affected, |sam-1/log4j=notaffected,rhs |sam-1/log4j=notaffected,rhs |cl-2/rh-java-common-log4j=a |cl-2/rh-java-common-log4j=a |ffected,jdg-6/log4j-core=ne |ffected,jdg-6/log4j-core=ne |w,soap-5/log4j=wontfix,jws- |w,soap-5/log4j=wontfix,jws- |3/log4j=notaffected,fedora- |3/log4j=affected,fedora-all |all/log4j12=affected |/log4j12=affected,eap-6/log | |4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=no |g4j=affected,eap-5/log4j=af |taffected,brms-5/log4j=wont |fected,brms-5/log4j=wontfix |fix,fsw-6/log4j=wontfix,fus |,fsw-6/log4j=wontfix,fuse-6 |e-6/log4j=affected,jon-3/lo |/log4j=affected,jon-3/log4j |g4j=notaffected,rhev-m-3/ja |=notaffected,rhev-m-3/jaspe |sperreports-server-pro=new, |rreports-server-pro=new,rhn |rhn_satellite_5/nutch=notaf |_satellite_5/nutch=notaffec |fected,openstack-7-optools/ |ted,openstack-7-optools/log |log4j=notaffected,rhmap-4/l |4j=notaffected,rhmap-4/log4 |og4j=notaffected,rhel-5/log |j=notaffected,rhel-5/log4j= |4j=wontfix,rhel-6/log4j=won |wontfix,rhel-6/log4j=wontfi |tfix,rhel-7/log4j=affected, |x,rhel-7/log4j=affected,sam |sam-1/log4j=notaffected,rhs |-1/log4j=notaffected,rhscl- |cl-2/rh-java-common-log4j=a |2/rh-java-common-log4j=affe |ffected,jdg-6/log4j-core=ne |cted,jdg-6/log4j-core=new,s |w,soap-5/log4j=wontfix,jws- |oap-5/log4j=wontfix,jws-3/l |3/log4j=affected,fedora-all |og4j=affected,fedora-all/lo |/log4j12=affected,eap-6/log |g4j12=affected,eap-6/log4j= |4j=affected |affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1467886, 1467885
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=new,rhn |rreports-server-pro=new,rhn |_satellite_5/nutch=notaffec |_satellite_5/nutch=notaffec |ted,openstack-7-optools/log |ted,openstack-7-optools/log |4j=notaffected,rhmap-4/log4 |4j=notaffected,rhmap-4/log4 |j=notaffected,rhel-5/log4j= |j=notaffected,rhel-5/log4j= |wontfix,rhel-6/log4j=wontfi |wontfix,rhel-6/log4j=wontfi |x,rhel-7/log4j=affected,sam |x,rhel-7/log4j=affected,sam |-1/log4j=notaffected,rhscl- |-1/log4j=notaffected,rhscl- |2/rh-java-common-log4j=affe |2/rh-java-common-log4j=affe |cted,jdg-6/log4j-core=new,s |cted,jdg-6/log4j-core=new,s |oap-5/log4j=wontfix,jws-3/l |oap-5/log4j=wontfix,jws-3/l |og4j=affected,fedora-all/lo |og4j=affected,fedora-all/lo |g4j12=affected,eap-6/log4j= |g4j12=affected,eap-6/log4j= |affected |affected,jbews-2/log4j=affe | |cted
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1467894
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |psotirop@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=new,rhn |rreports-server-pro=new,rhn |_satellite_5/nutch=notaffec |_satellite_5/nutch=notaffec |ted,openstack-7-optools/log |ted,openstack-7-optools/log |4j=notaffected,rhmap-4/log4 |4j=notaffected,rhmap-4/log4 |j=notaffected,rhel-5/log4j= |j=notaffected,rhel-5/log4j= |wontfix,rhel-6/log4j=wontfi |wontfix,rhel-6/log4j=wontfi |x,rhel-7/log4j=affected,sam |x,rhel-7/log4j=affected,sam |-1/log4j=notaffected,rhscl- |-1/log4j=notaffected,rhscl- |2/rh-java-common-log4j=affe |2/rh-java-common-log4j=affe |cted,jdg-6/log4j-core=new,s |cted,jdg-6/log4j-core=new,s |oap-5/log4j=wontfix,jws-3/l |oap-5/log4j=wontfix,jws-3/l |og4j=affected,fedora-all/lo |og4j=affected,fedora-all/lo |g4j12=affected,eap-6/log4j= |g4j12=affected,eap-6/log4j= |affected,jbews-2/log4j=affe |affected,jbews-2/log4j=affe |cted |cted,eap-7/log4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1446025
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1469402
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1469402 [Bug 1469402] (6.4.z) Upgrade log4j from 1.2.16 to 1.2.16.redhat-3
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server 3 for RHEL 7 Red Hat JBoss Web Server 3 for RHEL 6
Via RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1801
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Text-Only Advisories for JWS
Via RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:1802
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1477305
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2017:2423 https://access.redhat.com/errata/RHSA-2017:2423
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=new,rhn |rreports-server-pro=new,rhn |_satellite_5/nutch=notaffec |_satellite_5/nutch=notaffec |ted,openstack-7-optools/log |ted,openstack-7-optools/log |4j=notaffected,rhmap-4/log4 |4j=notaffected,rhmap-4/log4 |j=notaffected,rhel-5/log4j= |j=notaffected,rhel-5/log4j= |wontfix,rhel-6/log4j=wontfi |wontfix,rhel-6/log4j=wontfi |x,rhel-7/log4j=affected,sam |x,rhel-7/log4j=affected,sam |-1/log4j=notaffected,rhscl- |-1/log4j=notaffected,rhscl- |2/rh-java-common-log4j=affe |2/rh-java-common-log4j=affe |cted,jdg-6/log4j-core=new,s |cted,jdg-6/log4j-core=new,s |oap-5/log4j=wontfix,jws-3/l |oap-5/log4j=wontfix,jws-3/l |og4j=affected,fedora-all/lo |og4j=affected,fedora-all/lo |g4j12=affected,eap-6/log4j= |g4j12=affected,eap-6/log4j= |affected,jbews-2/log4j=affe |affected,jbews-2/log4j=wont |cted,eap-7/log4j=affected |fix,eap-7/log4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=new,rhn |rreports-server-pro=new,rhn |_satellite_5/nutch=notaffec |_satellite_5/nutch=notaffec |ted,openstack-7-optools/log |ted,openstack-7-optools/log |4j=notaffected,rhmap-4/log4 |4j=notaffected,rhmap-4/log4 |j=notaffected,rhel-5/log4j= |j=notaffected,rhel-5/log4j= |wontfix,rhel-6/log4j=wontfi |wontfix,rhel-6/log4j=wontfi |x,rhel-7/log4j=affected,sam |x,rhel-7/log4j=affected,sam |-1/log4j=notaffected,rhscl- |-1/log4j=notaffected,rhscl- |2/rh-java-common-log4j=affe |2/rh-java-common-log4j=affe |cted,jdg-6/log4j-core=new,s |cted,jdg-7/log4j-core=affec |oap-5/log4j=wontfix,jws-3/l |ted/impact=moderate,soap-5/ |og4j=affected,fedora-all/lo |log4j=wontfix,jws-3/log4j=a |g4j12=affected,eap-6/log4j= |ffected,fedora-all/log4j12= |affected,jbews-2/log4j=wont |affected,eap-6/log4j=affect |fix,eap-7/log4j=affected |ed,jbews-2/log4j=wontfix,ea | |p-7/log4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1485997
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=new,rhn |rreports-server-pro=wontfix |_satellite_5/nutch=notaffec |,rhn_satellite_5/nutch=nota |ted,openstack-7-optools/log |ffected,openstack-7-optools |4j=notaffected,rhmap-4/log4 |/log4j=notaffected,rhmap-4/ |j=notaffected,rhel-5/log4j= |log4j=notaffected,rhel-5/lo |wontfix,rhel-6/log4j=wontfi |g4j=wontfix,rhel-6/log4j=wo |x,rhel-7/log4j=affected,sam |ntfix,rhel-7/log4j=affected |-1/log4j=notaffected,rhscl- |,sam-1/log4j=notaffected,rh |2/rh-java-common-log4j=affe |scl-2/rh-java-common-log4j= |cted,jdg-7/log4j-core=affec |affected,jdg-7/log4j-core=a |ted/impact=moderate,soap-5/ |ffected/impact=moderate,soa |log4j=wontfix,jws-3/log4j=a |p-5/log4j=wontfix,jws-3/log |ffected,fedora-all/log4j12= |4j=affected,fedora-all/log4 |affected,eap-6/log4j=affect |j12=affected,eap-6/log4j=af |ed,jbews-2/log4j=wontfix,ea |fected,jbews-2/log4j=wontfi |p-7/log4j=affected |x,eap-7/log4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2017:2633 https://access.redhat.com/errata/RHSA-2017:2633
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
Via RHSA-2017:2636 https://access.redhat.com/errata/RHSA-2017:2636
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5
Via RHSA-2017:2637 https://access.redhat.com/errata/RHSA-2017:2637
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2017:2635 https://access.redhat.com/errata/RHSA-2017:2635
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2017:2638 https://access.redhat.com/errata/RHSA-2017:2638
https://bugzilla.redhat.com/show_bug.cgi?id=1443635 Bug 1443635 depends on bug 1469402, which changed state.
Bug 1469402 Summary: (6.4.z) Upgrade log4j from 1.2.16 to 1.2.16.redhat-3 https://bugzilla.redhat.com/show_bug.cgi?id=1469402
What |Removed |Added ---------------------------------------------------------------------------- Status|VERIFIED |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Brad Maxwell bmaxwell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |JBoss Issue Tracker | |JBPAPP-11265
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1493931
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1495452
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2017:2810 https://access.redhat.com/errata/RHSA-2017:2810
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
Via RHSA-2017:2808 https://access.redhat.com/errata/RHSA-2017:2808
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6
Via RHSA-2017:2809 https://access.redhat.com/errata/RHSA-2017:2809
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6
Via RHSA-2017:2811 https://access.redhat.com/errata/RHSA-2017:2811
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1477305 |
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1497821
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss BRMS
Via RHSA-2017:2888 https://access.redhat.com/errata/RHSA-2017:2888
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #35 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss BPM Suite
Via RHSA-2017:2889 https://access.redhat.com/errata/RHSA-2017:2889
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1507638
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #36 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Data Grid
Via RHSA-2017:3244 https://access.redhat.com/errata/RHSA-2017:3244
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1520314
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #37 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 5.2 security update
Via RHSA-2017:3400 https://access.redhat.com/errata/RHSA-2017:3400
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6
Via RHSA-2017:3399 https://access.redhat.com/errata/RHSA-2017:3399
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1520314 |
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |hchiorea@redhat.com, | |jolee@redhat.com, | |jstastny@redhat.com, | |vhalbert@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=wontfix |rreports-server-pro=wontfix |,rhn_satellite_5/nutch=nota |,rhn_satellite_5/nutch=nota |ffected,openstack-7-optools |ffected,openstack-7-optools |/log4j=notaffected,rhmap-4/ |/log4j=notaffected,rhmap-4/ |log4j=notaffected,rhel-5/lo |log4j=notaffected,rhel-5/lo |g4j=wontfix,rhel-6/log4j=wo |g4j=wontfix,rhel-6/log4j=wo |ntfix,rhel-7/log4j=affected |ntfix,rhel-7/log4j=affected |,sam-1/log4j=notaffected,rh |,sam-1/log4j=notaffected,rh |scl-2/rh-java-common-log4j= |scl-2/rh-java-common-log4j= |affected,jdg-7/log4j-core=a |affected,jdg-7/log4j-core=a |ffected/impact=moderate,soa |ffected/impact=moderate,soa |p-5/log4j=wontfix,jws-3/log |p-5/log4j=wontfix,jws-3/log |4j=affected,fedora-all/log4 |4j=affected,fedora-all/log4 |j12=affected,eap-6/log4j=af |j12=affected,eap-6/log4j=af |fected,jbews-2/log4j=wontfi |fected,jbews-2/log4j=wontfi |x,eap-7/log4j=affected |x,eap-7/log4j=affected,jdv- | |6/log4j=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1537684, 1537683
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Mark Knowles mknowles@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |bleanhar@redhat.com, | |ccoleman@redhat.com, | |dedgar@redhat.com, | |dmcphers@redhat.com, | |jgoulding@redhat.com, | |jkeck@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=wontfix |rreports-server-pro=wontfix |,rhn_satellite_5/nutch=nota |,rhn_satellite_5/nutch=nota |ffected,openstack-7-optools |ffected,openstack-7-optools |/log4j=notaffected,rhmap-4/ |/log4j=notaffected,rhmap-4/ |log4j=notaffected,rhel-5/lo |log4j=notaffected,rhel-5/lo |g4j=wontfix,rhel-6/log4j=wo |g4j=wontfix,rhel-6/log4j=wo |ntfix,rhel-7/log4j=affected |ntfix,rhel-7/log4j=affected |,sam-1/log4j=notaffected,rh |,sam-1/log4j=notaffected,rh |scl-2/rh-java-common-log4j= |scl-2/rh-java-common-log4j= |affected,jdg-7/log4j-core=a |affected,jdg-7/log4j-core=a |ffected/impact=moderate,soa |ffected/impact=moderate,soa |p-5/log4j=wontfix,jws-3/log |p-5/log4j=wontfix,jws-3/log |4j=affected,fedora-all/log4 |4j=affected,fedora-all/log4 |j12=affected,eap-6/log4j=af |j12=affected,eap-6/log4j=af |fected,jbews-2/log4j=wontfi |fected,jbews-2/log4j=wontfi |x,eap-7/log4j=affected,jdv- |x,eap-7/log4j=affected,jdv- |6/log4j=affected |6/log4j=affected,openshift- | |enterprise-3/log4j=new
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=wontfix |rreports-server-pro=wontfix |,rhn_satellite_5/nutch=nota |,rhn_satellite_5/nutch=nota |ffected,openstack-7-optools |ffected,openstack-7-optools |/log4j=notaffected,rhmap-4/ |/log4j=notaffected,rhmap-4/ |log4j=notaffected,rhel-5/lo |log4j=notaffected,rhel-5/lo |g4j=wontfix,rhel-6/log4j=wo |g4j=wontfix,rhel-6/log4j=wo |ntfix,rhel-7/log4j=affected |ntfix,rhel-7/log4j=affected |,sam-1/log4j=notaffected,rh |,sam-1/log4j=notaffected,rh |scl-2/rh-java-common-log4j= |scl-2/rh-java-common-log4j= |affected,jdg-7/log4j-core=a |affected,jdg-7/log4j-core=a |ffected/impact=moderate,soa |ffected/impact=moderate,soa |p-5/log4j=wontfix,jws-3/log |p-5/log4j=wontfix,jws-3/log |4j=affected,fedora-all/log4 |4j=affected,fedora-all/log4 |j12=affected,eap-6/log4j=af |j12=affected,eap-6/log4j=af |fected,jbews-2/log4j=wontfi |fected,jbews-2/log4j=wontfi |x,eap-7/log4j=affected,jdv- |x,eap-7/log4j=affected,jdv- |6/log4j=affected,openshift- |6/log4j=affected,openshift- |enterprise-3/log4j=new |enterprise-3/log4j=notaffec | |ted
--- Comment #44 from Jason Shepherd jshepherd@redhat.com --- This was fixed for OCP 3.5, and 3.6 here: https://access.redhat.com/errata/RHBA-2017:2548
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |drieden@redhat.com, | |jschatte@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70402,reported=20170417,sou |70402,reported=20170417,sou |rce=oss-security,cvss3=8.1/ |rce=oss-security,cvss3=8.1/ |CVSS:3.0/AV:N/AC:H/PR:N/UI: |CVSS:3.0/AV:N/AC:H/PR:N/UI: |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |N/S:U/C:H/I:H/A:H,cwe=CWE-5 |02,fedora-all/log4j=affecte |02,fedora-all/log4j=affecte |d,amq-6/log4j=affected,bpms |d,amq-6/log4j=affected,bpms |-6/log4j=affected,brms-6/lo |-6/log4j=affected,brms-6/lo |g4j=affected,eap-5/log4j=af |g4j=affected,eap-5/log4j=af |fected,brms-5/log4j=wontfix |fected,brms-5/log4j=wontfix |,fsw-6/log4j=wontfix,fuse-6 |,fsw-6/log4j=wontfix,fuse-6 |/log4j=affected,jon-3/log4j |/log4j=affected,jon-3/log4j |=notaffected,rhev-m-3/jaspe |=notaffected,rhev-m-3/jaspe |rreports-server-pro=wontfix |rreports-server-pro=wontfix |,rhn_satellite_5/nutch=nota |,rhn_satellite_5/nutch=nota |ffected,openstack-7-optools |ffected,openstack-7-optools |/log4j=notaffected,rhmap-4/ |/log4j=notaffected,rhmap-4/ |log4j=notaffected,rhel-5/lo |log4j=notaffected,rhel-5/lo |g4j=wontfix,rhel-6/log4j=wo |g4j=wontfix,rhel-6/log4j=wo |ntfix,rhel-7/log4j=affected |ntfix,rhel-7/log4j=affected |,sam-1/log4j=notaffected,rh |,sam-1/log4j=notaffected,rh |scl-2/rh-java-common-log4j= |scl-2/rh-java-common-log4j= |affected,jdg-7/log4j-core=a |affected,jdg-7/log4j-core=a |ffected/impact=moderate,soa |ffected/impact=moderate,soa |p-5/log4j=wontfix,jws-3/log |p-5/log4j=wontfix,jws-3/log |4j=affected,fedora-all/log4 |4j=affected,fedora-all/log4 |j12=affected,eap-6/log4j=af |j12=affected,eap-6/log4j=af |fected,jbews-2/log4j=wontfi |fected,jbews-2/log4j=wontfi |x,eap-7/log4j=affected,jdv- |x,eap-7/log4j=affected,jdv- |6/log4j=affected,openshift- |6/log4j=notaffected,openshi |enterprise-3/log4j=notaffec |ft-enterprise-3/log4j=notaf |ted |fected
java-sig-commits@lists.fedoraproject.org