Skip to content
Fencer Vulns
critical 9.8

CVE-2022-23305 in the critical feed json

SQL injection in JDBC Appender in Apache Log4j V1

published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-65fg-84f6-3jq3 , EUVD-2022-0477

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
66.5%
EPSS 66.5% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known

Summary

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Patch / fix

  • Apache Software Foundation Apache Log4j 1.x 2.0-alpha1
  • apache-log4j1.2 Debian 14, Debian 13, Debian 12 1.2.17-11

debian advisories DEBIAN-CVE-2022-23305

  • apache-log4j1.2 Ubuntu 18.04 LTS 1.2.17-8+deb10u1ubuntu0.2
  • apache-log4j1.2 Ubuntu 20.04 LTS 1.2.17-9ubuntu0.2
  • apache-log4j1.2 Ubuntu Pro 14.04 LTS 1.2.17-4ubuntu3+esm2
  • apache-log4j1.2 Ubuntu Pro 16.04 LTS 1.2.17-7ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2022-23305

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • uom-se RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896
  • si-units RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.6.5-2.module+el8+2463+615f6896
  • unit-api RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0-5.module+el8+2463+615f6896
  • uom-parent RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.3-3.module+el8+2463+615f6896
  • uom-systems RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.7-1.module+el8+2463+615f6896
  • uom-se-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.4-3.module+el8+2463+615f6896
  • uom-lib-javadoc RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.0.1-6.module+el8+2463+615f6896

red hat advisories RHSA-2024:10207RHSA-2022:0289RHSA-2022:0291RHSA-2022:0294RHSA-2022:0290RHSA-2022:1296

  • kafka OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.10.2.2-5.12.1
  • spark OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.6.3-8.12.1
  • storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.11.2
  • logstash OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.1-5.10.1
  • zookeeper OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.4.10-3.15.1
  • elasticsearch OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.2-5.6.1
  • venv-openstack-aodh OpenStack Cloud 8, HPE Helion OpenStack 8 5.1.1~dev7-12.40.1
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.43.1

suse advisories SUSE-SU-2022:0355-1SUSE-SU-2022:0354-1SUSE-SU-2022:0226-1SUSE-SU-2022:0214-1SUSE-SU-2022:0212-1SUSE-SU-2022:14881-1

  • kafka Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • kafka-kit Package Hub 15 SP3, openSUSE Leap 15.3 2.1.0-bp153.2.6.1
  • log4j12 openSUSE Leap 15.3 1.2.17-4.9.1
  • log4j openSUSE Leap 15.3 1.2.17-5.9.1

opensuse advisories openSUSE-SU-2022:0038-1openSUSE-SU-2022:0226-1openSUSE-SU-2022:0214-1

  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+235+62ea7738
  • uom-se AlmaLinux 8 1.0.4-3.module_el8.5.0+2610+de2b8c0b
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+235+62ea7738
  • parfait AlmaLinux 8 0.5.4-4.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+2610+de2b8c0b
  • uom-lib AlmaLinux 8 1.0.1-6.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+235+62ea7738
  • si-units AlmaLinux 8 0.6.5-2.module_el8.5.0+2610+de2b8c0b

almalinux advisories ALSA-2022:0290

  • uom-se Rocky Linux 8 1.0.4-3.module+el8.3.0+214+edf13b3f
  • parfait Rocky Linux 8 0.5.4-4.module+el8.5.0+728+553fbdb8
  • uom-lib Rocky Linux 8 1.0.1-6.module+el8.3.0+214+edf13b3f
  • si-units Rocky Linux 8 0.6.5-2.module+el8.3.0+214+edf13b3f
  • unit-api Rocky Linux 8 1.0-5.module+el8.3.0+214+edf13b3f
  • uom-parent Rocky Linux 8 1.0.3-3.module+el8.3.0+214+edf13b3f
  • uom-systems Rocky Linux 8 0.7-1.module+el8.3.0+214+edf13b3f

rocky linux advisories RLSA-2022:0290

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23305 updated cvss 8.8

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

  • Red Hat A-MQ Clients 2 log4j Red Hat AMQ Broker 7 log4j
    affected: workaround, no fix available
  • Red Hat JBoss Fuse Service Works 6 log4j Red Hat JBoss Operations Network 3 log4j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat EAP 6.4 log4j async
    fixed: vendor fix RHSA-2022:0437
  • Red Hat EAP 6.4.24 release
    fixed: vendor fix RHSA-2022:5458
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8 7.4-45, rh-sso-7/sso75-openshift-rhel8 7.5-17, rh-sso-7/sso7-rhel8-operator-bundle 7.5.1-9, rh-sso-7/sso74-openj9-openshift-rhel8 7.4-60
    fixed: vendor fix RHSA-2022:0450
  • Red Hat AMQ Streams 1.6.7
    fixed: vendor fix RHSA-2022:0467
show 7 more
  • Red Hat AMQ Streams 2.0.1
    fixed: vendor fix RHSA-2022:0469
  • Red Hat Data Grid 7.3.9
    fixed: vendor fix RHSA-2022:0430
  • Red Hat Enterprise Linux AppStream (v. 8) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0290
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0294
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0291
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) unit-api 1.0-5.module+el8+2463+615f6896, uom-se 1.0.4-3.module+el8+2463+615f6896, uom-lib 1.0.1-6.module+el8+2463+615f6896, si-units 0.6.5-2.module+el8+2463+615f6896, uom-systems 0.7-1.module+el8+2463+615f6896, uom-parent 1.0.3-3.module+el8+2463+615f6896, +9 more
    fixed: vendor fix RHSA-2022:0289
  • Red Hat Enterprise Linux Client (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Client Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server (v. 6 ELS) log4j 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server (v. 7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.3) log4j 1.2.17-17.el7_3
    +18 more products
    Red Hat Enterprise Linux Server AUS (v. 7.4) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server AUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional (v. 6 ELS) log4j-manual 1.2.14-6.6.el6_10, log4j-javadoc 1.2.14-6.6.el6_10 Red Hat Enterprise Linux Server Optional (v. 7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) log4j-manual 1.2.17-17.el7_3, log4j-javadoc 1.2.17-17.el7_3 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional AUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.6) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server Optional TUS (v. 7.7) log4j-manual 1.2.17-18.el7_4, log4j-javadoc 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.6) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.7) log4j 1.2.17-18.el7_4 Red Hat Enterprise Linux Workstation (v. 7) log4j 1.2.17-18.el7_4
    fixed: vendor fix RHSA-2022:0442

21 more fixed, 16 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

66.54% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven log4j:log4j
<=1.2.17
 no fix listed
maven org.zenframework.z8.dependencies.commons:log4j-1.2.17
<=2.0
 no fix listed

Affected products

  • Apache Software Foundation Apache Log4j 1.x

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.