Bug 2041959 (CVE-2022-23305)

Summary:	CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bdettelb, bgeorges, bibryam, bmaxwell, bmontgom, boliveir, brian.stansberry, btotty, caswilli, cdewolf, chazlett, clement.escoffier, csutherl, dandread, darran.lofthouse, dbecker, dkreling, dosoudil, drieden, ehelms, eleandro, eparis, etirelli, fjuma, ggaughan, gmalinko, gsmet, gzaronik, hamadhan, hbraun, hhorak, ibek, iweiss, janstey, jburrell, jclere, jjoyce, jnethert, jochrist, jokerman, jolee, jorton, jpallich, jperkins, jrokos, jross, jschatte, jschluet, jsherril, jstastny, jwong, jwon, kaycoth, krathod, kverlaen, kwills, lgao, lhh, loleary, lpeer, lsurette, lthon, lzap, mburns, mhulan, michal.skrivanek, mizdebsk, mkolesni, mmccune, mnovotny, mperina, msochure, msvehla, mszynkie, myarboro, nmoumoul, nobody, nstielau, nwallace, orabin, pantinor, pcreech, pdelbell, pdrozd, peholase, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rrajasek, rruss, rstancel, rsvoboda, sbiarozk, sbonazzo, sclewis, scohen, sd-operator-metering, sdouglas, slinaber, smaestri, spinder, sponnaga, sthorger, swoodman, szappis, tflannag, theute, tom.jenkinson, tzimanyi, vkumar, yborgess, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-01-26 15:31:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2042109, 2042110, 2042111, 2042112, 2042113, 2042114, 2042115, 2042116, 2042117, 2042118, 2042119, 2042120, 2042121, 2042122, 2042123, 2042124, 2042125, 2042126, 2042127, 2042128, 2042129, 2042130, 2042131, 2042132, 2042133, 2042134, 2042135, 2042136, 2042254, 2042255, 2042344, 2042713, 2042923, 2042924, 2042925, 2042926, 2042927, 2042928, 2042929, 2042930, 2042931, 2048758, 2048759
Bug Blocks:	2041943

Description Michael Kaplan 2022-01-18 15:48:34 UTC

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converted from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed.

Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs.

References: 

https://www.openwall.com/lists/oss-security/2022/01/18/4

Comment 2 juneau 2022-01-18 17:52:32 UTC

Marking /services "notaffected" per previous analysis/remediation.

Comment 26 errata-xmlrpc 2022-01-26 14:46:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:0294 https://access.redhat.com/errata/RHSA-2022:0294

Comment 27 errata-xmlrpc 2022-01-26 14:50:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0290 https://access.redhat.com/errata/RHSA-2022:0290

Comment 28 errata-xmlrpc 2022-01-26 14:51:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0291 https://access.redhat.com/errata/RHSA-2022:0291

Comment 29 errata-xmlrpc 2022-01-26 14:52:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0289 https://access.redhat.com/errata/RHSA-2022:0289

Comment 30 Product Security DevOps Team 2022-01-26 15:31:45 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-23305

Comment 32 errata-xmlrpc 2022-02-03 14:04:47 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.9

Via RHSA-2022:0430 https://access.redhat.com/errata/RHSA-2022:0430

Comment 33 errata-xmlrpc 2022-02-03 18:24:22 UTC

This issue has been addressed in the following products:

  EAP 7.4 log4j async

Via RHSA-2022:0435 https://access.redhat.com/errata/RHSA-2022:0435

Comment 34 errata-xmlrpc 2022-02-03 18:31:00 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:0436 https://access.redhat.com/errata/RHSA-2022:0436

Comment 35 errata-xmlrpc 2022-02-03 18:44:48 UTC

This issue has been addressed in the following products:

  EAP 6.4 log4j async

Via RHSA-2022:0437 https://access.redhat.com/errata/RHSA-2022:0437

Comment 36 errata-xmlrpc 2022-02-03 18:50:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2022:0438 https://access.redhat.com/errata/RHSA-2022:0438

Comment 37 errata-xmlrpc 2022-02-03 19:06:52 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:0439 https://access.redhat.com/errata/RHSA-2022:0439

Comment 38 errata-xmlrpc 2022-02-07 10:44:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support
  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2022:0442 https://access.redhat.com/errata/RHSA-2022:0442

Comment 39 errata-xmlrpc 2022-02-07 13:42:12 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2022:0444 https://access.redhat.com/errata/RHSA-2022:0444

Comment 40 errata-xmlrpc 2022-02-07 13:44:13 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.10

Via RHSA-2022:0446 https://access.redhat.com/errata/RHSA-2022:0446

Comment 41 errata-xmlrpc 2022-02-07 13:48:59 UTC

This issue has been addressed in the following products:

  RHSSO 7.5.1

Via RHSA-2022:0449 https://access.redhat.com/errata/RHSA-2022:0449

Comment 42 errata-xmlrpc 2022-02-07 13:52:57 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.5 for RHEL 8

Via RHSA-2022:0448 https://access.redhat.com/errata/RHSA-2022:0448

Comment 43 errata-xmlrpc 2022-02-07 13:54:14 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.5 for RHEL 7

Via RHSA-2022:0447 https://access.redhat.com/errata/RHSA-2022:0447

Comment 44 errata-xmlrpc 2022-02-07 14:23:55 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2022:0445 https://access.redhat.com/errata/RHSA-2022:0445

Comment 45 errata-xmlrpc 2022-02-07 14:48:22 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2022:0450 https://access.redhat.com/errata/RHSA-2022:0450

Comment 46 errata-xmlrpc 2022-02-08 12:53:00 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.6.7

Via RHSA-2022:0467 https://access.redhat.com/errata/RHSA-2022:0467

Comment 47 errata-xmlrpc 2022-02-08 13:57:00 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.0.1

Via RHSA-2022:0469 https://access.redhat.com/errata/RHSA-2022:0469

Comment 48 errata-xmlrpc 2022-02-08 16:57:30 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2022:0475 https://access.redhat.com/errata/RHSA-2022:0475

Comment 49 errata-xmlrpc 2022-02-09 13:11:26 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization 6.4.8.SP1

Via RHSA-2022:0497 https://access.redhat.com/errata/RHSA-2022:0497

Comment 50 errata-xmlrpc 2022-02-10 17:26:59 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization 6.4.8.SP2

Via RHSA-2022:0507 https://access.redhat.com/errata/RHSA-2022:0507

Comment 51 errata-xmlrpc 2022-02-14 17:07:21 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2022:0524 https://access.redhat.com/errata/RHSA-2022:0524

Comment 52 errata-xmlrpc 2022-02-14 17:31:40 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2022:0527 https://access.redhat.com/errata/RHSA-2022:0527

Comment 53 errata-xmlrpc 2022-02-15 18:54:55 UTC

This issue has been addressed in the following products:

  Red Hat Fuse/AMQ 6.3.20

Via RHSA-2022:0553 https://access.redhat.com/errata/RHSA-2022:0553

Comment 54 errata-xmlrpc 2022-02-23 20:01:06 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.10.1

Via RHSA-2022:0661 https://access.redhat.com/errata/RHSA-2022:0661

Comment 55 errata-xmlrpc 2022-04-11 12:57:00 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:1296 https://access.redhat.com/errata/RHSA-2022:1296

Comment 56 errata-xmlrpc 2022-04-11 12:58:30 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:1297 https://access.redhat.com/errata/RHSA-2022:1297

Comment 57 errata-xmlrpc 2022-04-11 13:01:14 UTC

This issue has been addressed in the following products:

  EAP 7.4.4 release

Via RHSA-2022:1299 https://access.redhat.com/errata/RHSA-2022:1299

Comment 62 errata-xmlrpc 2022-06-30 18:34:52 UTC

This issue has been addressed in the following products:

  EAP 6.4.24 release

Via RHSA-2022:5458 https://access.redhat.com/errata/RHSA-2022:5458

Comment 63 errata-xmlrpc 2022-06-30 18:56:33 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2022:5459 https://access.redhat.com/errata/RHSA-2022:5459

Comment 64 errata-xmlrpc 2022-06-30 19:11:31 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2022:5460 https://access.redhat.com/errata/RHSA-2022:5460

Comment 65 errata-xmlrpc 2024-08-26 11:05:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856

Comment 66 errata-xmlrpc 2024-11-25 00:12:22 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Via RHSA-2024:10207 https://access.redhat.com/errata/RHSA-2024:10207