8.8Hoch

CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Apache Software Foundation Apache Log4j 1.x Veröffentlicht: 2022-01-18 18:25 (vor 4 Jahren)

Beschreibung

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Apache Software Foundation	Apache Log4j 1.x	1.2.1 – < unspecified, unspecified – ≤ 2.0-alpha1

Referenzen und Patches

CVSS-Score

8.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

54.41%

höher als 99 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2022-01-17
Veröffentlicht2022-01-18 18:25
Bei IP-DB eingegangen2026-10-24 23:37
Zuletzt aktualisiert2026-05-27 16:44

Vergeben von (CNA): apache

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Apache Log4j

6.3Mittel

CVE-2026-49844 vor 3 Monaten

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Apache Software Foundation Apache Log4j API

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026…

6.3Mittel

CVE-2026-34481 vor 6 Monaten

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Apache Software Foundation Apache Log4j JSON Template Layout

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infini…

6.9Mittel

CVE-2026-34480 vor 6 Monaten

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Software Foundation Apache Log4j Core

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing inv…

1.0%EPSS

6.9Mittel

CVE-2026-34479 vor 6 Monaten

Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Software Foundation Apache Log4j 1 to Log4j 2 bridge

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, …

6.9Mittel

CVE-2026-34478 vor 6 Monaten

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Apache Software Foundation Apache Log4j Core

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration att…

6.3Mittel

CVE-2026-34477 vor 6 Monaten

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

Apache Software Foundation Apache Log4j Core

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j…