RHSA-2022:5053: Important: log4j security update
Log4j is a tool to help the programmer output log statements to a variety of output targets.Security Fix(es): log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:5053?
The severity of RHSA-2022:5053 is classified as critical due to the potential for remote code execution.
How do I fix RHSA-2022:5053?
To fix RHSA-2022:5053, update affected packages to version 1.2.14-6.7.el6_10 or later.
What vulnerabilities are addressed in RHSA-2022:5053?
RHSA-2022:5053 addresses the vulnerability CVE-2019-17571 related to the deserialization of untrusted data in SocketServer.
Which packages are affected by RHSA-2022:5053?
Affected packages include log4j, log4j-javadoc, log4j-debuginfo, and log4j-manual, all prior to version 1.2.14-6.7.el6_10.
How can I determine if my system is vulnerable to RHSA-2022:5053?
You can check your installed version of the log4j package and compare it against the version 1.2.14-6.7.el6_10 to assess vulnerability.