Deserialization of Untrusted Data in Apache Log4j

HIGH 8.8CVE-2022-23307 · GHSA-f7vh-qwp3-x37m · Published 18/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
log4j:log4j Maven	`≤ 1.2.17`	No fix yet
org.zenframework.z8.dependencies.commons:log4j-1.2.17 Maven	`≤ 2.0`	No fix yet
chainsaw apache	`< 2.1.0`	`2.1.0`
log4j apache	`≥ 1.2, < 2.0`	`2.0`
advanced supply chain planning oracle	`= 12.1= 12.2`	No fix yet
business intelligence oracle	`= 12.2.1.3.0= 12.2.1.4.0= 5.9.0.0.0`	No fix yet
business process management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
communications eagle ftp table base retrieval oracle	`= 4.5`	No fix yet
communications instant messaging server oracle	`= 10.0.1.5.0`	No fix yet
communications messaging server oracle	`= 8.1`	No fix yet
communications network integrity oracle	`= 7.3.6`	No fix yet
communications offline mediation controller oracle	`= 12.0.0.5.0< 12.0.0.4.4`	`12.0.0.4.4`
communications unified inventory management oracle	`= 7.4.1= 7.4.2`	No fix yet
e-business suite cloud manager and cloud backup module oracle	`= 2.2.1.1.1< 2.2.1.1.1`	`2.2.1.1.1`
enterprise manager base platform oracle	`= 13.4.0.0= 13.5.0.0`	No fix yet
financial services revenue management and billing analytics oracle	`= 2.7.0.0= 2.7.0.1= 2.8.0.0`	No fix yet
healthcare foundation oracle	`= 8.1.0`	No fix yet
hyperion data relationship management oracle	`< 11.2.8.0`	`11.2.8.0`
hyperion infrastructure technology oracle	`< 11.2.8.0`	`11.2.8.0`
identity management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
identity manager connector oracle	`= 11.1.1.5.0`	No fix yet
jdeveloper oracle	`= 12.2.1.3.0`	No fix yet
middleware common libraries and tools oracle	`= 12.2.1.4.0`	No fix yet
mysql enterprise monitor oracle	`≤ 8.0.29`	No fix yet
retail extract transform and load oracle	`= 13.2.5`	No fix yet
tuxedo oracle	`= 12.2.2.0.0`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	No fix yet
reload4j qos	`< 1.2.18.1`	`1.2.18.1`

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Users are advised to migrate from log4j:log4j to org.apache.logging.log4j:log4j for an updated version of the library.

NVD description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

References

nvd.nist.gov/vuln/detail/CVE-2022-23307 · ADVISORY
lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh · WEB
logging.apache.org/log4j/1.2/index.html · WEB
oracle.com/security-alerts/cpuapr2022.html · WEB
oracle.com/security-alerts/cpujul2022.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free