CVE-2022-23307
High
Description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Apache Chainsaw
PublishedJan 18, 2022
First seenJan 18, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- apache chainsaw2.1.0 or later
- apache log4j2.0 or later
- qos reload4j1.2.18.1 or later
- oracle communications_offline_mediation_controller12.0.0.4.4 or later
- oracle e-business_suite_cloud_manager_and_cloud_backup_module2.2.1.1.1 or later
- oracle hyperion_data_relationship_management11.2.8.0 or later
- oracle hyperion_infrastructure_technology11.2.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache chainsaw | v < 2.1.0 | 2.1.0 |
| apache log4j | 1.2 ≤ v < 2.0 | 2.0 |
| qos reload4j | v < 1.2.18.1 | 1.2.18.1 |
| oracle advanced_supply_chain_planning | 12.1, 12.2 | — |
| oracle business_intelligence | 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle business_process_management_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_eagle_ftp_table_base_retrieval | 4.5 | — |
| oracle communications_instant_messaging_server | 10.0.1.5.0 | — |
| oracle communications_messaging_server | 8.1 | — |
| oracle communications_network_integrity | 7.3.6 | — |
| oracle communications_offline_mediation_controller | v < 12.0.0.4.4, 12.0.0.5.0 | 12.0.0.4.4 |
| oracle communications_unified_inventory_management | 7.4.1, 7.4.2 | — |
| oracle e-business_suite_cloud_manager_and_cloud_backup_module | v < 2.2.1.1.1, 2.2.1.1.1 | 2.2.1.1.1 |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle financial_services_revenue_management_and_billing_analytics | 2.7.0.0, 2.7.0.1, 2.8.0.0 | — |
| oracle healthcare_foundation | 8.1.0 | — |
| oracle hyperion_data_relationship_management | v < 11.2.8.0 | 11.2.8.0 |
| oracle hyperion_infrastructure_technology | v < 11.2.8.0 | 11.2.8.0 |
| oracle identity_management_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle identity_manager_connector | 11.1.1.5.0 | — |
| oracle jdeveloper | 12.2.1.3.0 | — |
| oracle middleware_common_libraries_and_tools | 12.2.1.4.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.29 | — |
| oracle retail_extract_transform_and_load | 13.2.5 | — |
| oracle tuxedo | 12.2.2.0.0 | — |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| log4j:log4jMaven | v ≤ 1.2.17 | — |
| org.zenframework.z8.dependencies.commons:log4j-1.2.17Maven | v ≤ 2.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.