-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Fuse 7.10.1 release and security update Advisory ID: RHSA-2022:0661-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2022:0661 Issue date: 2022-02-23 CVE Names: CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 ==================================================================== 1. Summary: A minor version update (from 7.10 to 7.10.1) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.10.1 serves as a replacement for Red Hat Fuse 7.10, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.10 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/ 4. Bugs fixed (https://bugzilla.redhat.com/): 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender 2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink 2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender 2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer 5. References: https://access.redhat.com/security/cve/CVE-2021-4104 https://access.redhat.com/security/cve/CVE-2022-23302 https://access.redhat.com/security/cve/CVE-2022-23305 https://access.redhat.com/security/cve/CVE-2022-23307 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYhZdMtzjgjWX9erEAQgIEA//XnVYMHLAFtCBjFPQ/cDqZJQATTYwVuRh vz2rZ1k7kgO3ensjARLJuHWRyfxFxiXVwsr8Fzr6V6hqgsDbMMmkQwMlqw8kWvy5 cfXPKPx24fkXmErptLBWbwjLDKAAyw0rSca+ssR2u1jynk/9uELVOizbwGHkaPhL QrvF3f4AchzYDLg9lA3AhbqcmBdxpxbABhUIIs/5cI9r7igkrhZVUxglsQuR3wlP 8joIMDl+J9YuQ6uWG7cHrY5ZRaerJD/M09vUHA2IbJy6KvaWNeid5v9exOrZnP1j XDFsBlEKTs+TssdrgrQNBxmUWhxL0rP45hdOITyWWSV1eiwvxugOupPCWqiUT8bX qfeuw6zsiEDZHf8g0i72InTzdsp10FQlc8sSGWkx9LGMBW6v89El31kPHxrCpuye piG0wX1dF9fgPHTLxtOIxmWizb8i2JILQYlq4DlO51D5Ya6V/7H8V6/K/jk3hP64 GKi4YWo/1gzEEi+RuykYEUE5Ab2Pzztkvt+s47siLERA1IhqEGrBPT8o5mGDWrkC jaCe4nw1TvxAJ88CDE1048kNOGxdy/NBNQcakRNaqqGsRCd5rmRzD9+/nv7r2nvF O9Sd9JsLCpmmoF6Sko2mSne0qJdX8ISOe+xWWK9Kfa6DFaffU73PlBgPD6RuxZ3f 7sr++5C0fuM=Z5di -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce