-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat Fuse 7.8-7.10 security update Advisory ID: RHSA-2022:0203-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2022:0203 Issue date: 2022-01-20 CVE Names: CVE-2021-44228 CVE-2021-44832 CVE-2021-45046 CVE-2021-45105 ==================================================================== 1. Summary: A micro version update for Fuse 7.8, 7.9, and 7.10 is now available for Red Hat Fuse on Karaf and Red Hat Fuse on Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The releases of Red Hat Fuse 7.8.2, 7.9.1 and 7.10.1 serve as a patch to Red Hat Fuse on Karaf and Red Hat Fuse on Spring Boot and includes security fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es): * log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228) * log4j-core: remote code execution via JDBC Appender (CVE-2021-44832) * log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046) * log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse product documentation pages: Fuse 7.8: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/html/deploying_into_spring_boot/patch-red-hat-fuse-applications Fuse 7.9: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/html/deploying_into_spring_boot/patch-red-hat-fuse-applications Fuse 7.10: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/installing_on_apache_karaf/apply-hotfix-patch https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/html/deploying_into_spring_boot/patch-red-hat-fuse-applications 4. Bugs fixed (https://bugzilla.redhat.com/): 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 2032580 - CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) 2034067 - CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern 2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender 5. References: https://access.redhat.com/security/cve/CVE-2021-44228 https://access.redhat.com/security/cve/CVE-2021-44832 https://access.redhat.com/security/cve/CVE-2021-45046 https://access.redhat.com/security/cve/CVE-2021-45105 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=jboss.fuse&version=7.08.0 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=jboss.fuse&version=7.09.0 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=jboss.fuse&version=7.10.0 https://access.redhat.com/security/vulnerabilities/RHSB-2021-009 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYelE6dzjgjWX9erEAQiHJQ//TN+4LG+bu3jA5x9La0jpFFN0IXY3TyUd uuv/vWMci4ETaPxq3QWFMz0390j4RBjAdVVlf872+Az4oePm/w0uAG3ye2UMNYEc LtXVJ0xCusUw5YUrEnuL7QdBWzs2noIXxZyAh3upfxYfuLLfTDTFWYtX5EXaXvRC MsH+q8HaIal4YtDS9bCikiJbvw92UeO5M1UqFl0ih2UhVmPtBYkugNA95PTzz4DS BImKaFkh9IViBQJi/sKAzcS2BiQLXgvsIFIjq/GETysBYV/A0LJScXnspA1BLDkk 0J4L4uMSfePpUdV7PV3fjnAycIX6lRkYNMlJdk+RQ6KdCKpk5upqGACgJGXtmD6L 2cNJpdEwMuVZgMSQ++M33t8taPtv0wugN6Xi1i5pLK675V1Rn9PPeu3NE2MjDGCe GfVXMBPycB5/MEk39QEUNmecl2H9zqWvbfndCrTxN/M51UbZCcQ1CIa/6ACOEwMc kDy2MzTCIRGLh/ObtJZRB0MIIm5SP1zECoeVZCcDfOQTzZyMzS2EkgFgQFrC+tx6 LVkrQ2ElyRoTMO3FDzFBkiQ2eh18k+RcohKCMd7qa0HlKfvC+m5Ght5ZRKRFm7Tn 6i7WMKgnyQYDp8FEd8qygdioG+l59qi159M3AtolIPYIJlepsMUGEwEtxHvypXp3 EfETKCdv7pk=oqPi -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce