Skip to content
Fencer Vulns
high 8.8

CVE-2022-23302 in the critical feed json

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-w9p3-5cr8-m3jj , EUVD-2022-0721

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
63.8%
EPSS 63.8% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known

Summary

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Patch / fix

  • Apache Software Foundation Apache Log4j 1.x 2.0-alpha1
  • apache-log4j1.2 Debian 14, Debian 13, Debian 12 1.2.17-11

debian advisories DEBIAN-CVE-2022-23302

  • apache-log4j1.2 Ubuntu 18.04 LTS 1.2.17-8+deb10u1ubuntu0.2
  • apache-log4j1.2 Ubuntu 20.04 LTS 1.2.17-9ubuntu0.2
  • apache-log4j1.2 Ubuntu Pro 14.04 LTS 1.2.17-4ubuntu3+esm2
  • apache-log4j1.2 Ubuntu Pro 16.04 LTS 1.2.17-7ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2022-23302

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • uom-se RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896
  • si-units RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.6.5-2.module+el8+2463+615f6896
  • unit-api RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0-5.module+el8+2463+615f6896
  • uom-parent RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.3-3.module+el8+2463+615f6896
  • uom-systems RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.7-1.module+el8+2463+615f6896
  • uom-se-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896

red hat advisories RHSA-2022:0289RHSA-2022:0291RHSA-2022:0294RHSA-2022:0290RHSA-2022:1296RHSA-2022:1297

  • kafka OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.10.2.2-5.12.1
  • spark OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.6.3-8.12.1
  • storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.11.2
  • logstash OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.1-5.10.1
  • zookeeper OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.4.10-3.15.1
  • elasticsearch OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.2-5.6.1
  • venv-openstack-aodh OpenStack Cloud 8, HPE Helion OpenStack 8 5.1.1~dev7-12.40.1
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.43.1

suse advisories SUSE-SU-2022:0355-1SUSE-SU-2022:0354-1SUSE-SU-2022:0226-1SUSE-SU-2022:0214-1SUSE-SU-2022:0212-1SUSE-SU-2022:14881-1

  • kafka-kit openSUSE Tumbleweed 2.1.0-3.1
  • kafka Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • kafka-kit Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • log4j12 openSUSE Leap 15.3 1.2.17-4.9.1
  • log4j openSUSE Leap 15.3 1.2.17-5.9.1

opensuse advisories openSUSE-SU-2024:11838-1openSUSE-SU-2022:0038-1openSUSE-SU-2022:0226-1openSUSE-SU-2022:0214-1

  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+235+62ea7738
  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+2610+de2b8c0b
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+235+62ea7738
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+2610+de2b8c0b

almalinux advisories ALSA-2022:0290

  • uom-se Rocky Linux 8 1.0.4-3.module+el8.3.0+214+edf13b3f
  • parfait Rocky Linux 8 0.5.4-4.module+el8.5.0+728+553fbdb8
  • uom-lib Rocky Linux 8 1.0.1-6.module+el8.3.0+214+edf13b3f
  • si-units Rocky Linux 8 0.6.5-2.module+el8.3.0+214+edf13b3f
  • unit-api Rocky Linux 8 1.0-5.module+el8.3.0+214+edf13b3f
  • uom-parent Rocky Linux 8 1.0.3-3.module+el8.3.0+214+edf13b3f
  • uom-systems Rocky Linux 8 0.7-1.module+el8.3.0+214+edf13b3f

rocky linux advisories RLSA-2022:0290

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23302 updated cvss 8.8

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink

  • Red Hat A-MQ Clients 2 log4j Red Hat AMQ Broker 7 log4j
    affected: workaround, no fix available
  • Red Hat JBoss Fuse Service Works 6 log4j Red Hat JBoss Operations Network 3 log4j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat EAP 6.4 log4j async
    fixed: vendor fix RHSA-2022:0437
  • Red Hat EAP 6.4.24 release
    fixed: vendor fix RHSA-2022:5458
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8 7.4-45, rh-sso-7/sso75-openshift-rhel8 7.5-17, rh-sso-7/sso7-rhel8-operator-bundle 7.5.1-9, rh-sso-7/sso74-openj9-openshift-rhel8 7.4-60
    fixed: vendor fix RHSA-2022:0450
  • Red Hat AMQ Streams 1.6.7
    fixed: vendor fix RHSA-2022:0467
show 7 more
  • Red Hat AMQ Streams 2.0.1
    fixed: vendor fix RHSA-2022:0469
  • Red Hat Data Grid 7.3.9
    fixed: vendor fix RHSA-2022:0430
  • Red Hat Enterprise Linux AppStream (v. 8) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0290
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0294
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0291
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0289
  • Red Hat Enterprise Linux Client (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Client Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server (v. 6 ELS) log4j 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.3) log4j 1.2.17-17.el7_3
    +18 more products
    Red Hat Enterprise Linux Server AUS (v. 7.4) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-manual 1.2.14-6.6.el6_10, log4j-javadoc 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-manual 1.2.17-17.el7_3, log4j-javadoc 1.2.17-17.el7_3 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Workstation (v. 7) log4j 1.2.17-18.el7_4
    fixed: vendor fix RHSA-2022:0442

20 more fixed, 16 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

63.84% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven log4j:log4j
<=1.2.17
 no fix listed
maven org.zenframework.z8.dependencies.commons:log4j-1.2.17
<=2.0
 no fix listed

Affected products

  • Apache Software Foundation Apache Log4j 1.x

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.