Bug 2182864 (CVE-2023-26464) - CVE-2023-26464 log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging
Summary: CVE-2023-26464 log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-26464
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2182903 2182907 2182893 2182906 2182908 2182909 2182910 2182911 2182912 2182913 2182914 2182915 2182916 2182917 2182918 2182919 2182920 2182921 2182922 2182923 2182924 2182925 2182926 2182927 2182928
Blocks: 2048808
TreeView+ depends on / blocked
 
Reported: 2023-03-29 19:57 UTC by Chess Hazlett
Modified: 2024-03-17 22:37 UTC (History)
124 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Chainsaw and SocketAppender components with Log4j 1.x on JRE, less than 1.7. This issue may allow an attacker to use a logging entry with a specially-crafted hashmap or hashtable, depending on which logging component is in use, to process and exhaust the available memory in the virtual machine, resulting in a Denial of Service when the object is deserialized. This issue affects Apache Log4j before version 2.
Clone Of:
Environment:
Last Closed: 2023-06-19 20:38:00 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3663 0 None None None 2023-06-19 10:13:21 UTC
Red Hat Product Errata RHSA-2023:5484 0 None None None 2023-10-05 20:21:45 UTC
Red Hat Product Errata RHSA-2023:5485 0 None None None 2023-10-05 20:22:19 UTC
Red Hat Product Errata RHSA-2023:5486 0 None None None 2023-10-05 20:23:31 UTC
Red Hat Product Errata RHSA-2023:5488 0 None None None 2023-10-05 20:18:36 UTC

Description Chess Hazlett 2023-03-29 19:57:08 UTC 
Deserialization of a specially-crafted logging entry involving hashmap or hashtable could cause Denial of Service by exhausting the available memory in the virtual machine. This issue appears to affect only Java 1.6 or older versions.
Comment 1 Chess Hazlett 2023-03-29 21:56:00 UTC 
Created log4j tracking bugs for this issue:

Affects: fedora-all [bug 2182893]
Comment 2 Chess Hazlett 2023-03-29 22:41:28 UTC 
Created log4j-jboss-logmanager tracking bugs for this issue:

Affects: epel-all [bug 2182903]
Comment 6 Marek Novotny 2023-03-30 09:44:35 UTC 
the CVE says it is vulnerable only on java runtimes less than 1.7, which is basically not used for products in last 2 years.
"When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7"

Please consider to evaluate this in reporting more bugs and do not make noise if that is out of the range ;)
Comment 16 errata-xmlrpc 2023-06-19 10:13:14 UTC 
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.11

Via RHSA-2023:3663 https://access.redhat.com/errata/RHSA-2023:3663
Comment 17 Product Security DevOps Team 2023-06-19 20:37:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-26464
Comment 19 errata-xmlrpc 2023-10-05 20:18:30 UTC 
This issue has been addressed in the following products:

  EAP 7.4.13

Via RHSA-2023:5488 https://access.redhat.com/errata/RHSA-2023:5488
Comment 20 errata-xmlrpc 2023-10-05 20:21:38 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:5484 https://access.redhat.com/errata/RHSA-2023:5484
Comment 21 errata-xmlrpc 2023-10-05 20:22:12 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:5485 https://access.redhat.com/errata/RHSA-2023:5485
Comment 22 errata-xmlrpc 2023-10-05 20:23:23 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:5486 https://access.redhat.com/errata/RHSA-2023:5486
Note You need to log in before you can comment on or make changes to this bug.