[Bug 2032580] New: CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
12:30 p.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Bug ID: 2032580
Summary: CVE-2021-45046 log4j-core: thread context message
pattern and context lookup pattern vulnerable to DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bdettelb(a)redhat.com, bgeorges(a)redhat.com,
bibryam(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
boliveir(a)redhat.com, brian.stansberry(a)redhat.com,
btotty(a)redhat.com, caswilli(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
clement.escoffier(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
dbhole(a)redhat.com, devrim(a)gunduz.org,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, ehelms(a)redhat.com,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ewolinet(a)redhat.com,
fjuma(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gsmet(a)redhat.com,
hamadhan(a)redhat.com, hbraun(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jnethert(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jrokos(a)redhat.com,
jross(a)redhat.com, jschluet(a)redhat.com,
jsherril(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mburns(a)redhat.com, mhulan(a)redhat.com,
mizdebsk(a)redhat.com, mkolesni(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nmoumoul(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, orabin(a)redhat.com,
pantinor(a)redhat.com, paul.wouters(a)aiven.io,
pcreech(a)redhat.com, pdelbell(a)redhat.com,
pdrozd(a)redhat.com, peholase(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, probinso(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
sbiarozk(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sd-operator-metering(a)redhat.com,
sdouglas(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, sponnaga(a)redhat.com,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tflannag(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
vkumar(a)redhat.com, yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was
incomplete in certain non-default configurations. This could allows attackers
with control over Thread Context Map (MDC) input data when the logging
configuration uses a non-default Pattern Layout with either a Context Lookup
(for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or
%MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a
denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to
localhost by default. Note that previous mitigations involving configuration
such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT
mitigate this specific vulnerability.
Log4j 2.16.0 fixes this issue by removing support for message lookup patterns
and disabling JNDI functionality by default.
This issue can be mitigated in prior releases (<2.16.0) by removing the
JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar
org/apache/logging/log4j/core/lookup/JndiLookup.class).
Reference:
https://www.openwall.com/lists/oss-security/2021/12/14/4
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:30 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2032581
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2032581
[Bug 2032581] CVE-2021-45046 log4j: log4j-core: thread context message pattern
and context lookup pattern vulnerable to DoS [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:30 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created log4j tracking bugs for this issue:
Affects: fedora-all [bug 2032581]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:33 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2030930
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:33 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core:
|thread context message |thread context message
|pattern and context lookup |pattern and context lookup
|pattern vulnerable to DoS |pattern vulnerable to DoS
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
1:32 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: thread context message pattern and context lookup pattern vulnerable to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #2 from Przemyslaw Roguski <proguski(a)redhat.com> ---
upstream advisory:
https://logging.apache.org/log4j/2.x/security.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
1:47 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core:
|thread context message |DoS in log4j 2.x with
|pattern and context lookup |thread context message
|pattern vulnerable to DoS |pattern and context lookup
| |pattern
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
1:49 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|CVE-2021-45046 log4j-core: |CVE-2021-45046 log4j-core:
|DoS in log4j 2.x with |DoS in log4j 2.x with
|thread context message |thread context message
|pattern and context lookup |pattern and context lookup
|pattern |pattern (incomplete fix for
| |CVE-2021-44228)
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:59 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Florencio Cano <fcanogab(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2032754
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
4:47 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski <proguski(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |log4j 2.16.0
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:25 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Doc Text *updated* by Paramvir jindal <pjindal(a)redhat.com> ---
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before
2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could
craft malicious input using a JNDI Lookup pattern resulting in a denial of service (DOS)
attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
6:07 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski <proguski(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2030986
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
6:18 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Przemyslaw Roguski <proguski(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2031028
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
2:09 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #6 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.8
Via RHSA-2021:5148 https://access.redhat.com/errata/RHSA-2021:5148
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
2:09 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5148
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:13 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5106 https://access.redhat.com/errata/RHSA-2021:5106
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:13 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5106
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
1:50 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #8 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:5141 https://access.redhat.com/errata/RHSA-2021:5141
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
1:50 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5141
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
9 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.7
Via RHSA-2021:5107 https://access.redhat.com/errata/RHSA-2021:5107
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
9 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5107
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
10:56 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #10 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-45046
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
10:56 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |ERRATA
Status|NEW |CLOSED
Last Closed| |2021-12-16 16:56:56
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
8:37 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #12 from Yadnyawalk Tale <ytale(a)redhat.com> ---
Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is
not affected as it uses logback framework for logging.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
9:52 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|low |medium
Priority|low |medium
--- Doc Text *updated* ---
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before
2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could
craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE)
in a limited number of environments.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
9:32 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
yuk <fadamo(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |fadamo(a)gmail.com
--- Comment #13 from yuk <fadamo(a)gmail.com> ---
And what about the fix for Red Hat JBoss Enterprise Application Platform 7
marked as affected?
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:30 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2034754
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:31 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2030985
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:21 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yasuhiro Ozone <yozone(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |security-response-team@redh
| |at.com
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
6:10 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(security-response |needinfo?(jwon(a)redhat.com)
|-team(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
10:17 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jwon(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
3:52 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yasuhiro Ozone <yozone(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
4:40 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(security-response |needinfo?(jwon(a)redhat.com)
|-team(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
11:49 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jwon(a)redhat.com) |needinfo?(ytale(a)redhat.com)
CC| |ytale(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(ytale(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
7:37 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Mithilesh Kaur Bagga <mbagga(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mbagga(a)redhat.com
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
8:10 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(security-response |needinfo?(jwon(a)redhat.com)
|-team(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:15 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Bug 2032580 depends on bug 2032581, which changed state.
Bug 2032581 Summary: CVE-2021-45046 log4j: log4j-core: DoS in log4j 2.x with thread
context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2032581
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |CURRENTRELEASE
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
11:19 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Ted Jongseok Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jwon(a)redhat.com) |needinfo?(hvyas(a)redhat.com)
CC| |hvyas(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
11:59 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
Hardik Vyas <hvyas(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(hvyas(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
3:26 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #24 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.8.2
7.9.1
7.10.1
Via RHSA-2022:0203 https://access.redhat.com/errata/RHSA-2022:0203
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
3:27 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0203
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:40 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #25 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Data Grid 8.2.3
Via RHSA-2022:0205 https://access.redhat.com/errata/RHSA-2022:0205
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
5:40 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0205
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
6:13 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #26 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Vert.x 4.1.8
Via RHSA-2022:0083 https://access.redhat.com/errata/RHSA-2022:0083
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
6:13 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0083
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
10 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #27 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
EAP 7.4 log4j async
Via RHSA-2022:0216 https://access.redhat.com/errata/RHSA-2022:0216
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
10 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0216
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:54 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #28 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Integration Camel Extensions for Quarkus 2.2
Via RHSA-2022:0222 https://access.redhat.com/errata/RHSA-2022:0222
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:54 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0222
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:56 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #29 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Integration Camel-K 1.6.3
Via RHSA-2022:0223 https://access.redhat.com/errata/RHSA-2022:0223
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
12:57 p.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:0223
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
7:56 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #30 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2022:1296 https://access.redhat.com/errata/RHSA-2022:1296
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
7:56 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1296
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
7:58 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #31 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2022:1297 https://access.redhat.com/errata/RHSA-2022:1297
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
7:58 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1297
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
8 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
--- Comment #32 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
EAP 7.4.4 release
Via RHSA-2022:1299 https://access.redhat.com/errata/RHSA-2022:1299
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
8:01 a.m.
New subject: [Bug 2032580] CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1299
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2032580
770
days inactive
888
days old
java-sig-commits@lists.fedoraproject.org
57 comments
1 participants
participants (1)
-
bugzilla＠redhat.com