红帽产品勘误 RHSA-2022:0524 - Security Advisory
发布：
2022-02-14
已更新：
2022-02-14

RHSA-2022:0524 - Security Advisory

概述

Low: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update

类型/严重性

Security Advisory: Low

Red Hat Insights 补丁分析

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update is now available for Red Hat JBoss Web Server 3.1 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 14 serves as a replacement for Red Hat JBoss Web Server 3.1 Service Pack 13. This release includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

  • log4j-eap6: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink [jws-3] (CVE-2022-23302)
  • log4j-eap6: log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender [jws-3] (CVE-2022-23305)
  • log4j-eap6: log4j: Unsafe deserialization flaw in Chainsaw log viewer [jws-3] (CVE-2022-23307)
  • log4j-eap6: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [jws-3.1] (CVE-2021-4104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

Before applying this update, ensure that all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • JBoss Enterprise Web Server 3 for RHEL 7 x86_64

修复

  • BZ - 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender
  • BZ - 2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
  • BZ - 2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
  • BZ - 2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer

JBoss Enterprise Web Server 3 for RHEL 7

SRPM
log4j-eap6-1.2.17-3.redhat_00008.1.ep6.el7.src.rpm SHA-256: 54c553bdd01517f268758d172dfd050d891535bc675a11463af1b8c5599a7687
tomcat-native-1.2.23-26.redhat_26.ep7.el7.src.rpm SHA-256: be24173f7d7b127de194a09fd14cfab117c37f06d26a75f68f0d886f3db596f9
tomcat7-7.0.70-46.ep7.el7.src.rpm SHA-256: 1ff1ff4b8c914c3fb88e3d98ad0df9305157132493108bde2c5e0d1afa49f20c
tomcat8-8.0.36-49.ep7.el7.src.rpm SHA-256: de99bf686c9538e19c38b0dee44556020ea8e935da50382cd5b6ddfd9e5cb92a
x86_64
log4j-eap6-1.2.17-3.redhat_00008.1.ep6.el7.noarch.rpm SHA-256: 04f9ba70cf8198ef65566fc4cc0430a685b7607c94cd8e598a6376f6cf5eef20
tomcat-native-1.2.23-26.redhat_26.ep7.el7.x86_64.rpm SHA-256: 844f1fe9ac981148b9506442cd58d6b5447a3f396a028d5deefccc2319c6a712
tomcat-native-debuginfo-1.2.23-26.redhat_26.ep7.el7.x86_64.rpm SHA-256: afbe355141e56f5f469cd2d6b0d06ab074fd7acdff28ea97150cf2a751de8986
tomcat7-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 6ea2e899b83437c1dc2ed98c3c091bc74b5dc631860a0fcf313e0f0d6ec10878
tomcat7-admin-webapps-7.0.70-46.ep7.el7.noarch.rpm SHA-256: cc9e3108a781d9675c3568a9de85558b6dcea20d9a4e4be74e5ad6ded8c44b6e
tomcat7-docs-webapp-7.0.70-46.ep7.el7.noarch.rpm SHA-256: e662f73f77e4a610d30eed6b4d685abd6353b46a6d75f34fd5076da8de089b38
tomcat7-el-2.2-api-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 4b027da0369362a037efb6d8937a43fb865e6cd321e441c404b5c55cd1196828
tomcat7-javadoc-7.0.70-46.ep7.el7.noarch.rpm SHA-256: a6e984d831903d5e8c7ccb1194a7d436a15ae10aa3db7fee01afefc9e44af1ca
tomcat7-jsp-2.2-api-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 29396a8b3e8cbb6532060cdd678af64f8874df41f6622686ebf3ec8dc4d05531
tomcat7-jsvc-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 14c4b3992a2bd9bf81dd23f32ac2dd12773db78f36edec8d62f95e579def3e8c
tomcat7-lib-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 911e1f23558642b15c2996f8feff9d61a456a6cecd23efb1596c86838d9e22ec
tomcat7-log4j-7.0.70-46.ep7.el7.noarch.rpm SHA-256: d0370a261d96397669828b90ebe708ae0fe1b0dbd07e2a5b7977a5fd1109e0eb
tomcat7-selinux-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 7b5203ca139afffd2abf2026d0b6776d73f89241d483fbeaf137e4e79dac4cc5
tomcat7-servlet-3.0-api-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 9c79b47b48f906b58a63e46d1a7f6b3e5c4328504050c2dd89b5157f890e1bfb
tomcat7-webapps-7.0.70-46.ep7.el7.noarch.rpm SHA-256: 539c55a33c9aac608c743dc78d25974afbbff55b553d28fa221713cd18c769f7
tomcat8-8.0.36-49.ep7.el7.noarch.rpm SHA-256: a2147868709e653e5d8bdc4fe0199d50c1aa9b4990bebf2f5436b72f27eff758
tomcat8-admin-webapps-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 0658ed887012b129f9c9055c658a18f7a052f282a26dfb4e46ac7d27002c389e
tomcat8-docs-webapp-8.0.36-49.ep7.el7.noarch.rpm SHA-256: fd25205a5420d860936330c45cc5fb0c15a35401f3b7bc92e0647e625baf5f73
tomcat8-el-2.2-api-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 25a5c58a49c034f22be5bb1a953071541a73bde1e2f54c3332a35d2dd8194cc1
tomcat8-javadoc-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 685abcacc817d355bb7c5e503e6a509d875f872a50f84527c2bf9a9a475cc489
tomcat8-jsp-2.3-api-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 58d51a2e197001e02a00ba0969a82be4c7c44add1102cd0ba595e8076eba40b8
tomcat8-jsvc-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 393c1af5b4b284f4e20b360ed477cae54359d06c11b6df6b1f83ca6e68e81ae9
tomcat8-lib-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 28dc371cbd7c8a3ae24408e4122b1bc1e155f9cb2aaa635ffcc378e7e77e48cc
tomcat8-log4j-8.0.36-49.ep7.el7.noarch.rpm SHA-256: ec852e0d5ea664b88ea2600c94395ba57e6728a974372b3a7aafe227c9899b83
tomcat8-selinux-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 3e8429af5ed48f4a3d4f2b972f1298656df5df85c01f05701359f6e6ea652976
tomcat8-servlet-3.1-api-8.0.36-49.ep7.el7.noarch.rpm SHA-256: a73ca775ec03d8efc2a67568d5cb1236d3cf0175c9906fe008183d3deff682da
tomcat8-webapps-8.0.36-49.ep7.el7.noarch.rpm SHA-256: 9df8de4cc519c6361dce0b17d3adde163848a4023d2430c7060dba1c891ec26c

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。