-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Fuse 7.10.1 release and security update
Advisory ID:       RHSA-2022:0661-01
Product:           Red Hat JBoss Fuse
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0661
Issue date:        2022-02-23
CVE Names:         CVE-2021-4104 CVE-2022-23302 CVE-2022-23305
                   CVE-2022-23307
====================================================================
1. Summary:

A minor version update (from 7.10 to 7.10.1) is now available for Red Hat
Fuse. The purpose of this text-only errata is to inform you about the
security issues fixed in this release.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

This release of Red Hat Fuse 7.10.1 serves as a replacement for Red Hat
Fuse 7.10, and includes bug fixes and enhancements, which are documented in
the Release Notes document linked to in the References.

Security Fix(es):

* log4j: Remote code execution in Log4j 1.x when application is configured
to use JMSAppender (CVE-2021-4104)

* log4j: Remote code execution in Log4j 1.x when application is configured
to use JMSSink (CVE-2022-23302)

* log4j: SQL injection in Log4j 1.x when application is configured to use
JDBCAppender (CVE-2022-23305)

* log4j: Unsafe deserialization flaw in Chainsaw log viewer
(CVE-2022-23307)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

Installation instructions are available from the Fuse 7.10 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/

4. Bugs fixed (https://bugzilla.redhat.com/):

2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender
2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer

5. References:

https://access.redhat.com/security/cve/CVE-2021-4104
https://access.redhat.com/security/cve/CVE-2022-23302
https://access.redhat.com/security/cve/CVE-2022-23305
https://access.redhat.com/security/cve/CVE-2022-23307
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYhZdMtzjgjWX9erEAQgIEA//XnVYMHLAFtCBjFPQ/cDqZJQATTYwVuRh
vz2rZ1k7kgO3ensjARLJuHWRyfxFxiXVwsr8Fzr6V6hqgsDbMMmkQwMlqw8kWvy5
cfXPKPx24fkXmErptLBWbwjLDKAAyw0rSca+ssR2u1jynk/9uELVOizbwGHkaPhL
QrvF3f4AchzYDLg9lA3AhbqcmBdxpxbABhUIIs/5cI9r7igkrhZVUxglsQuR3wlP
8joIMDl+J9YuQ6uWG7cHrY5ZRaerJD/M09vUHA2IbJy6KvaWNeid5v9exOrZnP1j
XDFsBlEKTs+TssdrgrQNBxmUWhxL0rP45hdOITyWWSV1eiwvxugOupPCWqiUT8bX
qfeuw6zsiEDZHf8g0i72InTzdsp10FQlc8sSGWkx9LGMBW6v89El31kPHxrCpuye
piG0wX1dF9fgPHTLxtOIxmWizb8i2JILQYlq4DlO51D5Ya6V/7H8V6/K/jk3hP64
GKi4YWo/1gzEEi+RuykYEUE5Ab2Pzztkvt+s47siLERA1IhqEGrBPT8o5mGDWrkC
jaCe4nw1TvxAJ88CDE1048kNOGxdy/NBNQcakRNaqqGsRCd5rmRzD9+/nv7r2nvF
O9Sd9JsLCpmmoF6Sko2mSne0qJdX8ISOe+xWWK9Kfa6DFaffU73PlBgPD6RuxZ3f
7sr++5C0fuM=Z5di
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce