CVE-2022-23307

Опубликовано: 18 янв. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Ссылки

https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh
Mailing List
Vendor Advisory
https://logging.apache.org/log4j/1.2/index.html
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh
Mailing List
Vendor Advisory
https://logging.apache.org/log4j/1.2/index.html
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:chainsaw:*:*:*:*:*:*:*:*

Версия до 2.1.0 (исключая)

cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*

Версия от 1.2 (включая) до 2.0 (исключая)

Конфигурация 2

cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:*

Версия до 1.2.18.1 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*

Версия до 12.0.0.4.4 (исключая)

cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:*:*:*:*:*:*:*:*

Версия до 2.2.1.1.1 (исключая)

cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*

Версия до 11.2.8.0 (исключая)

cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:*

Версия до 11.2.8.0 (исключая)

cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия до 8.0.29 (включая)

cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00752

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2022-23307

CVSS3: 8.8

ubuntu

больше 3 лет назад

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVE-2022-23307

CVSS3: 8.8

redhat

больше 3 лет назад

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVE-2022-23307

CVSS3: 8.8

debian

больше 3 лет назад

CVE-2020-9493 identified a deserialization issue that was present in A ...

GHSA-f7vh-qwp3-x37m

CVSS3: 9.8

github

больше 3 лет назад

Deserialization of Untrusted Data in Apache Log4j

BDU:2022-01069

CVSS3: 9.8

fstec

больше 3 лет назад

Уязвимость библиотеки журналирования Java-программ Log4j, связанная с восстановлением в памяти недостоверных данных, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 72%

0.00752

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502