[CLSA-2022:1648069165] Fix of CVE: CVE-2022-23307, CVE-2021-4104, CVE-2022-23305, CVE-2022-23302
Type:
security
Severity:
moderate
Release date:
2022-03-23
Description:
- CVE-2022-23302: remove JMSSink component entrirely - CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups - CVE-2022-23307: restrict chainsaw access list to classes from SYSTEM_ALLOWED_CLASSES group - CVE-2021-4104: disable JMSAppender by default and add option to manually enable it
Updated packages:
  • log4j12-1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1.noarch.rpm
    sha:cced6f449d0784b7b0cef51bffe2854369858ca4
  • log4j12-javadoc-1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1.noarch.rpm
    sha:5b8c1775df64c73c8b507457b118cbdc9c100bf3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.