Skip to content
Fencer Vulns
high 8.8

CVE-2022-23307 in the critical feed json

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-f7vh-qwp3-x37m , EUVD-2022-0575

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
54.4%
EPSS 54.4% chance of exploitation in 30 days, percentile 99%
public exploits
0
none known

Summary

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Patch / fix

  • apache chainsaw 2.1.0
  • apache log4j 2.0
  • qos reload4j 1.2.18.1
  • oracle communications_offline_mediation_controller 12.0.0.4.4
  • oracle e-business_suite_cloud_manager_and_cloud_backup_module 2.2.1.1.1
  • oracle hyperion_data_relationship_management 11.2.8.0
  • oracle hyperion_infrastructure_technology 11.2.8.0
  • apache-log4j1.2 Debian 14, Debian 13, Debian 12 1.2.17-11

debian advisories DEBIAN-CVE-2022-23307

  • apache-log4j1.2 Ubuntu 18.04 LTS 1.2.17-8+deb10u1ubuntu0.2
  • apache-log4j1.2 Ubuntu 20.04 LTS 1.2.17-9ubuntu0.2
  • apache-log4j1.2 Ubuntu Pro 14.04 LTS 1.2.17-4ubuntu3+esm2
  • apache-log4j1.2 Ubuntu Pro 16.04 LTS 1.2.17-7ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2022-23307

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • uom-se RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896
  • si-units RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.6.5-2.module+el8+2463+615f6896
  • unit-api RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0-5.module+el8+2463+615f6896
  • uom-parent RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.3-3.module+el8+2463+615f6896
  • uom-systems RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.7-1.module+el8+2463+615f6896
  • uom-se-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896

red hat advisories RHSA-2024:10207RHSA-2022:0289RHSA-2022:0291RHSA-2022:0294RHSA-2022:0290RHSA-2022:1296

  • kafka OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.10.2.2-5.12.1
  • spark OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.6.3-8.12.1
  • storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.11.2
  • logstash OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.1-5.10.1
  • zookeeper OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.4.10-3.15.1
  • elasticsearch OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.2-5.6.1
  • venv-openstack-aodh OpenStack Cloud 8, HPE Helion OpenStack 8 5.1.1~dev7-12.40.1
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.43.1

suse advisories SUSE-SU-2022:0355-1SUSE-SU-2022:0354-1SUSE-SU-2022:0226-1SUSE-SU-2022:0214-1SUSE-SU-2022:0212-1SUSE-SU-2022:14881-1

  • kafka-kit openSUSE Tumbleweed 2.1.0-3.1
  • kafka Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • kafka-kit Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • log4j12 openSUSE Leap 15.3 1.2.17-4.9.1
  • log4j openSUSE Leap 15.3 1.2.17-5.9.1

opensuse advisories openSUSE-SU-2024:11838-1openSUSE-SU-2022:0038-1openSUSE-SU-2022:0226-1openSUSE-SU-2022:0214-1

  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+235+62ea7738
  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+2610+de2b8c0b
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+235+62ea7738
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+2610+de2b8c0b

almalinux advisories ALSA-2022:0290

  • uom-se Rocky Linux 8 1.0.4-3.module+el8.3.0+214+edf13b3f
  • parfait Rocky Linux 8 0.5.4-4.module+el8.5.0+728+553fbdb8
  • uom-lib Rocky Linux 8 1.0.1-6.module+el8.3.0+214+edf13b3f
  • si-units Rocky Linux 8 0.6.5-2.module+el8.3.0+214+edf13b3f
  • unit-api Rocky Linux 8 1.0-5.module+el8.3.0+214+edf13b3f
  • uom-parent Rocky Linux 8 1.0.3-3.module+el8.3.0+214+edf13b3f
  • uom-systems Rocky Linux 8 0.7-1.module+el8.3.0+214+edf13b3f

rocky linux advisories RLSA-2022:0290

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23307 updated cvss 8.8

log4j: Unsafe deserialization flaw in Chainsaw log viewer

  • Red Hat A-MQ Clients 2 log4j Red Hat AMQ Broker 7 log4j
    affected: workaround, no fix available
  • Red Hat JBoss Fuse Service Works 6 log4j Red Hat JBoss Operations Network 3 log4j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat EAP 6.4 log4j async
    fixed: vendor fix RHSA-2022:0437
  • Red Hat EAP 6.4.24 release
    fixed: vendor fix RHSA-2022:5458
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8 7.4-45, rh-sso-7/sso75-openshift-rhel8 7.5-17, rh-sso-7/sso7-rhel8-operator-bundle 7.5.1-9, rh-sso-7/sso74-openj9-openshift-rhel8 7.4-60
    fixed: vendor fix RHSA-2022:0450
  • Red Hat AMQ Streams 1.6.7
    fixed: vendor fix RHSA-2022:0467
show 7 more
  • Red Hat AMQ Streams 2.0.1
    fixed: vendor fix RHSA-2022:0469
  • Red Hat Data Grid 7.3.9
    fixed: vendor fix RHSA-2022:0430
  • Red Hat Enterprise Linux AppStream (v. 8) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0290
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0294
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0291
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0289
  • Red Hat Enterprise Linux Client (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Client Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server (v. 6 ELS) log4j 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.3) log4j 1.2.17-17.el7_3
    +18 more products
    Red Hat Enterprise Linux Server AUS (v. 7.4) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-manual 1.2.14-6.6.el6_10, log4j-javadoc 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-manual 1.2.17-17.el7_3, log4j-javadoc 1.2.17-17.el7_3 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Workstation (v. 7) log4j 1.2.17-18.el7_4
    fixed: vendor fix RHSA-2022:0442

21 more fixed, 16 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

54.41% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven log4j:log4j
<=1.2.17
 no fix listed
maven org.zenframework.z8.dependencies.commons:log4j-1.2.17
<=2.0
 no fix listed

Affected products

  • Apache Software Foundation Apache Log4j 1.x

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.