[CLSA-2022:1648067792] Fix of CVE: CVE-2021-4104, CVE-2022-23305, CVE-2022-23302, CVE-2022-23307
Type:
security
Severity:
moderate
Release date:
2022-03-23
Description:
- CVE-2022-23302: remove JMSSink component entrirely - CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups - CVE-2022-23307: restrict chainsaw access list to classes from SYSTEM_ALLOWED_CLASSES group - CVE-2021-4104: disable JMSAppender by default and add option to manually enable it
Updated packages:
  • log4j12-javadoc-1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1.noarch.rpm
    sha:b558dcd5f97faffd93a378da895850e5d0f56f8d
  • log4j12-1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1.noarch.rpm
    sha:66471132e055bbb5780906e71d6177f3b7fbccb2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.