Every CVE Search/ Get API key

CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

7.5 HighPublic exploitFix available

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

80.6%Up 78.8 points since Dec 15, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
CVE-2021-4104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List 7.5

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
CVE-2021-4104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2021-2514 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
EUVD-2021-2514
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fp5r-v3w9-4333 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
GHSA-fp5r-v3w9-4333
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
CVE-2021-4104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-4104 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
DEBIAN-CVE-2021-4104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 47 moreShow less
OSVGHSA-fp5r-v3w9-4333 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
GHSA-fp5r-v3w9-4333
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVOESA-2022-1513 9.8

log4j12 security update

With log4j it is possible to enable logging at runtime without modifying the application binary.

Security Fix(es):

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.(CVE-2021-4104)

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.(CVE-2022-23307)

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.(CVE-2022-23302)

Record
OESA-2022-1513
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-2065 9.8

log4j12 security update

With log4j it is possible to enable logging at runtime without modifying the application binary.

Security Fix(es):

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.(CVE-2021-4104)

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.(CVE-2022-23307)

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.(CVE-2022-23302)

Record
OESA-2022-2065
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:5206 7.5

Red Hat Security Advisory: log4j security update

Record
RHSA-2021:5206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:5269 7.5

Red Hat Security Advisory: rh-maven36-log4j12 security update

Record
RHSA-2021:5269
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0289 8.8

Red Hat Security Advisory: parfait:0.5 security update

Record
RHSA-2022:0289
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0290 8.8

Red Hat Security Advisory: parfait:0.5 security update

Record
RHSA-2022:0290
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0291 8.8

Red Hat Security Advisory: parfait:0.5 security update

Record
RHSA-2022:0291
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0294 8.8

Red Hat Security Advisory: parfait:0.5 security update

Record
RHSA-2022:0294
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0436 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

Record
RHSA-2022:0436
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0438 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update

Record
RHSA-2022:0438
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0447 8.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7

Record
RHSA-2022:0447
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0448 8.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8

Record
RHSA-2022:0448
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0475 8.8

Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1]

Record
RHSA-2022:0475
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0524 8.8

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update

Record
RHSA-2022:0524
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1296 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update

Record
RHSA-2022:1296
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1297 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update

Record
RHSA-2022:1297
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:5459 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update

Record
RHSA-2022:5459
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:5460 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update

Record
RHSA-2022:5460
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:10207 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update

Record
RHSA-2024:10207
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:5856 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update

Record
RHSA-2024:5856
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0290 8.8

Important: parfait:0.5 security update

Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot (PCP) using the Memory Mapped Value (MMV) machinery for extremely lightweight instrumentation.

Security Fix(es):

  • log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

  • log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

  • log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)

  • log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0290
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-4104 7.5

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Record
UBUNTU-CVE-2021-4104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:0290 No score

Important: parfait:0.5 security update

Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot (PCP) using the Memory Mapped Value (MMV) machinery for extremely lightweight instrumentation.

Security Fix(es):

  • log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

  • log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

  • log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)

  • log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0290
Updated
2026-11-02
OSVCLSA-2022-1642429303 No score

Fixed CVE-2021-4104 in log4j

  • CVE-2021-4104: Fix remote code execution vulnerability
Record
CLSA-2022-1642429303
Updated
2026-11-02
OSVCLSA-2022-1642429400 No score

Fix of CVE: CVE-2021-4104

  • CVE-2021-4104: Fix remote code execution vulnerability
Record
CLSA-2022-1642429400
Updated
2026-11-02
OSVCLSA-2022-1648067792 No score

Fix of CVE: CVE-2021-4104, CVE-2022-23305, CVE-2022-23302, CVE-2022-23307

  • CVE-2022-23302: remove JMSSink component entrirely
  • CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups
  • CVE-2022-23307: restrict chainsaw access list to classes from SYSTEM_ALLOWED_CLASSES group
  • CVE-2021-4104: disable JMSAppender by default and add option to manually enable it
Record
CLSA-2022-1648067792
Updated
2026-11-02
OSVCLSA-2022-1648069165 No score

Fix of CVE: CVE-2022-23307, CVE-2021-4104, CVE-2022-23305, CVE-2022-23302

  • CVE-2022-23302: remove JMSSink component entrirely
  • CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups
  • CVE-2022-23307: restrict chainsaw access list to classes from SYSTEM_ALLOWED_CLASSES group
  • CVE-2021-4104: disable JMSAppender by default and add option to manually enable it
Record
CLSA-2022-1648069165
Updated
2026-11-02
OSVCLSA-2025-1751328204 No score

TuxCare security update for log4j:log4j (6 CVEs)

TuxCare rebuilt log4j:log4j to address 6 CVEs. Fixed in 1.2.17.tuxcare.1.

Record
CLSA-2025-1751328204
Updated
2026-11-02
OSVCLSA-2026-1786547487 No score

TuxCare security update for org.springframework.pulsar (3 CVEs)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 3 CVEs. Fixed in 1.2.13-tuxcare.1.

Record
CLSA-2026-1786547487
Updated
2026-11-02
OSVCLSA-2026-1787141079 No score

TuxCare security update for log4j:log4j (1 CVE)

TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.16-tuxcare.2.

Record
CLSA-2026-1787141079
Updated
2026-11-02
OSVCLSA-2026-1787546974 No score

TuxCare security update for log4j:log4j (1 CVE)

TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.14-tuxcare.1.

Record
CLSA-2026-1787546974
Updated
2026-11-02
OSVCLSA-2026-1787557465 No score

TuxCare security update for log4j:log4j (4 CVEs)

TuxCare rebuilt log4j:log4j to address 4 CVEs. Fixed in 1.2.15-tuxcare.1.

Record
CLSA-2026-1787557465
Updated
2026-11-02
OSVCLSA-2026-1789407479 No score

TuxCare security update for log4j:log4j (2 CVEs)

TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.12-tuxcare.1.

Record
CLSA-2026-1789407479
Updated
2026-11-02
OSVCLSA-2026-1789407656 No score

TuxCare security update for log4j:log4j (2 CVEs)

TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.13-tuxcare.1.

Record
CLSA-2026-1789407656
Updated
2026-11-02
OSVMGASA-2023-0141 No score

Updated davmail packages fix security vulnerability

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. (CVE-2019-17571) JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. (CVE-2021-4104) JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. (CVE-2022-23302) By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. (CVE-2022-23305)

Record
MGASA-2023-0141
Updated
2026-11-02
OSVopenSUSE-SU-2021:1612-1 No score

Security update for log4j12

This update for log4j12 fixes the following issues:

  • CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662]

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1612-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1631-1 No score

Security update for kafka

This security update of kafka fixes the following issue:

  • CVE-2021-4104: Remove JMSAppender from log4j jars during build to prevent bsc#1193662,
Record
openSUSE-SU-2021:1631-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4111-1 No score

Security update for log4j

This update for log4j fixes the following issue:

  • CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662]
Record
openSUSE-SU-2021:4111-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4112-1 No score

Security update for log4j12

This update for log4j12 fixes the following issues:

  • CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662]
Record
openSUSE-SU-2021:4112-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0038-1 No score

Security update for kafka

This update for kafka, kafka-kit fixes following issues:

  • Remove JDBCAppender, JMSSink, chainsaw from log4j jars during build to prevent bsc#1194842, CVE-2022-23302, bsc#1194843, CVE-2022-23305, bsc#1194844, CVE-2022-23307

  • Rebuild with kafka-kit change to Remove JMSAppender from log4j jars during build to prevent bsc#1193662, CVE-2021-4104

Record
openSUSE-SU-2022:0038-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11681-1 No score

log4j-2.16.0-2.1 on GA media

These are all security issues fixed in the log4j-2.16.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11681-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11682-1 No score

chainsaw-1.2.17-5.1 on GA media

These are all security issues fixed in the chainsaw-1.2.17-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11682-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11696-1 No score

kafka-kit-2.1.0-2.1 on GA media

These are all security issues fixed in the kafka-kit-2.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11696-1
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2021-4104 No score

CVE-2021-4104 in log4j:log4j - Patched by Root

Root has patched CVE-2021-4104 in the log4j:log4j package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2021-4104
Updated
2026-11-02
OSVSUSE-SU-2021:14866-1 No score

Security update for log4j

This update for log4j fixes the following issues:

  • CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662]
Record
SUSE-SU-2021:14866-1
Updated
2026-11-02
OSVSUSE-SU-2021:4096-1 No score

Security update for storm

This update for storm fixes the following issues:

  • Remove JndiLookup from log4j 2.x jars during build to prevent 'log4shell' code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228)
  • Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104)
Record
SUSE-SU-2021:4096-1
Updated
2026-11-02

Affected products

Show 35 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
log4j:log4j
Maven
 1.2.0 to 1.2.17 None known
org.zenframework.z8.dependencies.commons:log4j-1.2.17
Maven
 through 2.0 None known
parfait
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+235+62ea7738
0.5.4-4.module_el8.5.0+235+62ea7738
parfait
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+2610+de2b8c0b
0.5.4-4.module_el8.5.0+2610+de2b8c0b
parfait-examples
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+2610+de2b8c0b
0.5.4-4.module_el8.5.0+2610+de2b8c0b
parfait-examples
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+235+62ea7738
0.5.4-4.module_el8.5.0+235+62ea7738
parfait-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+235+62ea7738
0.5.4-4.module_el8.5.0+235+62ea7738
parfait-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+2610+de2b8c0b
0.5.4-4.module_el8.5.0+2610+de2b8c0b
pcp-parfait-agent
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+2610+de2b8c0b
0.5.4-4.module_el8.5.0+2610+de2b8c0b
pcp-parfait-agent
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.5.4-4.module_el8.5.0+235+62ea7738
0.5.4-4.module_el8.5.0+235+62ea7738
Show 290 moreShow less
Affected packages
PackageAffectedFixed
si-units
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.6.5-2.module_el8.5.0+235+62ea7738
0.6.5-2.module_el8.5.0+235+62ea7738
si-units
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.6.5-2.module_el8.5.0+2610+de2b8c0b
0.6.5-2.module_el8.5.0+2610+de2b8c0b
si-units-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.6.5-2.module_el8.5.0+2610+de2b8c0b
0.6.5-2.module_el8.5.0+2610+de2b8c0b
si-units-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.6.5-2.module_el8.5.0+235+62ea7738
0.6.5-2.module_el8.5.0+235+62ea7738
unit-api
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0-5.module_el8.5.0+2610+de2b8c0b
1.0-5.module_el8.5.0+2610+de2b8c0b
unit-api
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0-5.module_el8.5.0+235+62ea7738
1.0-5.module_el8.5.0+235+62ea7738
unit-api-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0-5.module_el8.5.0+2610+de2b8c0b
1.0-5.module_el8.5.0+2610+de2b8c0b
unit-api-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0-5.module_el8.5.0+235+62ea7738
1.0-5.module_el8.5.0+235+62ea7738
uom-lib
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.1-6.module_el8.5.0+2610+de2b8c0b
1.0.1-6.module_el8.5.0+2610+de2b8c0b
uom-lib
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.1-6.module_el8.5.0+235+62ea7738
1.0.1-6.module_el8.5.0+235+62ea7738
uom-lib-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.1-6.module_el8.5.0+2610+de2b8c0b
1.0.1-6.module_el8.5.0+2610+de2b8c0b
uom-lib-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.1-6.module_el8.5.0+235+62ea7738
1.0.1-6.module_el8.5.0+235+62ea7738
uom-parent
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.3-3.module_el8.5.0+235+62ea7738
1.0.3-3.module_el8.5.0+235+62ea7738
uom-parent
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.3-3.module_el8.5.0+2610+de2b8c0b
1.0.3-3.module_el8.5.0+2610+de2b8c0b
uom-se
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.4-3.module_el8.5.0+235+62ea7738
1.0.4-3.module_el8.5.0+235+62ea7738
uom-se
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.4-3.module_el8.5.0+2610+de2b8c0b
1.0.4-3.module_el8.5.0+2610+de2b8c0b
uom-se-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.4-3.module_el8.5.0+235+62ea7738
1.0.4-3.module_el8.5.0+235+62ea7738
uom-se-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.0.4-3.module_el8.5.0+2610+de2b8c0b
1.0.4-3.module_el8.5.0+2610+de2b8c0b
uom-systems
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.7-1.module_el8.5.0+235+62ea7738
0.7-1.module_el8.5.0+235+62ea7738
uom-systems
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.7-1.module_el8.5.0+2610+de2b8c0b
0.7-1.module_el8.5.0+2610+de2b8c0b
uom-systems-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.7-1.module_el8.5.0+2610+de2b8c0b
0.7-1.module_el8.5.0+2610+de2b8c0b
uom-systems-javadoc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 0.7-1.module_el8.5.0+235+62ea7738
0.7-1.module_el8.5.0+235+62ea7738
log4j
TuxCare:OracleLinux:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j-javadoc
TuxCare:OracleLinux:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j-manual
TuxCare:OracleLinux:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j
TuxCare:CentOS:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j-javadoc
TuxCare:CentOS:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j-manual
TuxCare:CentOS:6
 before 1.2.14-6.4.el6.tuxcare.els1
1.2.14-6.4.el6.tuxcare.els1
log4j12
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1
1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1
log4j12-javadoc
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1
1.2.17-24.module_el8.5.0+2018+25f04681.tuxcare.els1
log4j12
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1
1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1
log4j12-javadoc
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1
1.2.17-24.module_el8.4.0+2019+25f04681.tuxcare.els1
log4j:log4j
TuxCare:Maven
From an advisory covering 6 CVEs
 1.2.17 up to 1.2.17.tuxcare.1
1.2.17.tuxcare.1
log4j:log4j
TuxCare:Maven
 1.2.16 up to 1.2.16-tuxcare.2, plus listed versions
1.2.16-tuxcare.1
1.2.16-tuxcare.2
log4j:log4j
TuxCare:Maven
 1.2.14 up to 1.2.14-tuxcare.1
1.2.14-tuxcare.1
log4j:log4j
TuxCare:Maven
From an advisory covering 4 CVEs
 1.2.15 up to 1.2.15-tuxcare.1
1.2.15-tuxcare.1
log4j:log4j
TuxCare:Maven
From an advisory covering 2 CVEs
 1.2.12 up to 1.2.12-tuxcare.1
1.2.12-tuxcare.1
log4j:log4j
TuxCare:Maven
From an advisory covering 2 CVEs
 1.2.13 up to 1.2.13-tuxcare.1
1.2.13-tuxcare.1
apache-log4j1.2
Debian:12
 before 1.2.17-11
1.2.17-11
apache-log4j1.2
Debian:13
 before 1.2.17-11
1.2.17-11
apache-log4j1.2
Debian:14
 before 1.2.17-11
1.2.17-11
apache-log4j1.2
Debian:9
From an advisory covering 4 CVEs
 before 1.2.17-7+deb9u2, plus listed versions
1.2.17-71.2.17-7+deb9u1
1.2.17-7+deb9u2
log4j:log4j
Maven
 1.2.0 to 1.2.17, plus listed versions
1.2.111.2.121.2.131.2.141.2.15
Show 7 moreShow less
1.2.161.2.41.2.51.2.61.2.71.2.81.2.9
 None known
davmail
Mageia:8
From an advisory covering 4 CVEs
 before 6.1.0-1.mga8
6.1.0-1.mga8
log4j12
openEuler:20.03-LTS-SP1
From an advisory covering 3 CVEs
 before 1.2.17-25.oe1
1.2.17-25.oe1
log4j12
openEuler:20.03-LTS-SP2
From an advisory covering 3 CVEs
 before 1.2.17-25.oe1
1.2.17-25.oe1
log4j12
openEuler:20.03-LTS-SP3
From an advisory covering 3 CVEs
 before 1.2.17-25.oe1
1.2.17-25.oe1
log4j12
openEuler:22.03-LTS
From an advisory covering 3 CVEs
 before 1.2.17-25.oe2203
1.2.17-25.oe2203
log4j
Red Hat:rhel_els:6
 before 0:1.2.14-6.5.el6_10
0:1.2.14-6.5.el6_10
log4j-debuginfo
Red Hat:rhel_els:6
 before 0:1.2.14-6.5.el6_10
0:1.2.14-6.5.el6_10
log4j-javadoc
Red Hat:rhel_els:6
 before 0:1.2.14-6.5.el6_10
0:1.2.14-6.5.el6_10
log4j-manual
Red Hat:rhel_els:6
 before 0:1.2.14-6.5.el6_10
0:1.2.14-6.5.el6_10
log4j
Red Hat:enterprise_linux:7::client
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:enterprise_linux:7::client
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:enterprise_linux:7::client
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_aus:7.3::server
 before 0:1.2.17-16.el7_3
0:1.2.17-16.el7_3
log4j
Red Hat:rhel_aus:7.4::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_aus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_e4s:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_tus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_aus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_e4s:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:rhel_tus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:enterprise_linux:7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_aus:7.3::server
 before 0:1.2.17-16.el7_3
0:1.2.17-16.el7_3
log4j-manual
Red Hat:rhel_aus:7.3::server
 before 0:1.2.17-16.el7_3
0:1.2.17-16.el7_3
log4j-javadoc
Red Hat:rhel_aus:7.4::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_aus:7.4::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_aus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_aus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_e4s:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_e4s:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_tus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_tus:7.6::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_aus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_aus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_e4s:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_e4s:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:rhel_tus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:rhel_tus:7.7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:enterprise_linux:7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:enterprise_linux:7::server
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-javadoc
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
log4j-manual
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.17-17.el7_4
0:1.2.17-17.el7_4
rh-maven36-log4j12
Red Hat:rhel_software_collections:3::el7
 before 0:1.2.17-23.3.el7
0:1.2.17-23.3.el7
rh-maven36-log4j12-javadoc
Red Hat:rhel_software_collections:3::el7
 before 0:1.2.17-23.3.el7
0:1.2.17-23.3.el7
parfait
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
parfait-examples
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
parfait-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
pcp-parfait-agent
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
0:0.5.4-4.module+el8.4.0+13998+1b70e2b7
si-units
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
si-units-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
unit-api
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
unit-api-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
uom-lib
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-lib-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-parent
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0.3-3.module+el8+2463+615f6896
0:1.0.3-3.module+el8+2463+615f6896
uom-se
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-se-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-systems
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
uom-systems-javadoc
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
parfait
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
parfait-examples
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
parfait-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
pcp-parfait-agent
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
0:0.5.4-4.module+el8.5.0+13988+de2b8c0b
si-units
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
si-units-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
unit-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
unit-api-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
uom-lib
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-lib-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-parent
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0.3-3.module+el8+2463+615f6896
0:1.0.3-3.module+el8+2463+615f6896
uom-se
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-se-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-systems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
uom-systems-javadoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
parfait
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.2.0+13999+fa2fb353
0:0.5.4-4.module+el8.2.0+13999+fa2fb353
parfait-examples
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.2.0+13999+fa2fb353
0:0.5.4-4.module+el8.2.0+13999+fa2fb353
parfait-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.2.0+13999+fa2fb353
0:0.5.4-4.module+el8.2.0+13999+fa2fb353
pcp-parfait-agent
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.2.0+13999+fa2fb353
0:0.5.4-4.module+el8.2.0+13999+fa2fb353
si-units
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
si-units-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
unit-api
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
unit-api-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
uom-lib
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-lib-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-parent
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0.3-3.module+el8+2463+615f6896
0:1.0.3-3.module+el8+2463+615f6896
uom-se
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-se-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-systems
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
uom-systems-javadoc
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
parfait
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.1.0+14000+df5fdac7
0:0.5.4-4.module+el8.1.0+14000+df5fdac7
parfait-examples
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.1.0+14000+df5fdac7
0:0.5.4-4.module+el8.1.0+14000+df5fdac7
parfait-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.1.0+14000+df5fdac7
0:0.5.4-4.module+el8.1.0+14000+df5fdac7
pcp-parfait-agent
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.1.0+14000+df5fdac7
0:0.5.4-4.module+el8.1.0+14000+df5fdac7
si-units
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
si-units-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8+2463+615f6896
0:0.6.5-2.module+el8+2463+615f6896
unit-api
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
unit-api-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8+2463+615f6896
0:1.0-5.module+el8+2463+615f6896
uom-lib
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-lib-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8+2463+615f6896
0:1.0.1-6.module+el8+2463+615f6896
uom-parent
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0.3-3.module+el8+2463+615f6896
0:1.0.3-3.module+el8+2463+615f6896
uom-se
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-se-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8+2463+615f6896
0:1.0.4-3.module+el8+2463+615f6896
uom-systems
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
uom-systems-javadoc
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8+2463+615f6896
0:0.7-1.module+el8+2463+615f6896
eap7-log4j-jboss-logmanager
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 4 CVEs
 before 0:1.2.2-1.Final_redhat_00002.1.el7eap
0:1.2.2-1.Final_redhat_00002.1.el7eap
eap7-log4j-jboss-logmanager
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 4 CVEs
 before 0:1.2.2-1.Final_redhat_00002.1.el8eap
0:1.2.2-1.Final_redhat_00002.1.el8eap
log4j-eap6
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 4 CVEs
 before 0:1.2.17-3.redhat_00008.1.ep6.el6
0:1.2.17-3.redhat_00008.1.ep6.el6
log4j-jboss-logmanager
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 4 CVEs
 before 0:1.1.4-3.Final_redhat_00002.1.ep6.el6
0:1.1.4-3.Final_redhat_00002.1.ep6.el6
log4j-eap6
Red Hat:jboss_enterprise_application_platform:6::el7
From an advisory covering 4 CVEs
 before 0:1.2.17-3.redhat_00008.1.ep6.el7
0:1.2.17-3.redhat_00008.1.ep6.el7
log4j-jboss-logmanager
Red Hat:jboss_enterprise_application_platform:6::el7
From an advisory covering 4 CVEs
 before 0:1.1.4-3.Final_redhat_00002.1.ep6.el7
0:1.1.4-3.Final_redhat_00002.1.ep6.el7
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.5::el7
From an advisory covering 5 CVEs
 before 0:15.0.4-1.redhat_00003.1.el7sso
0:15.0.4-1.redhat_00003.1.el7sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.5::el7
From an advisory covering 5 CVEs
 before 0:15.0.4-1.redhat_00003.1.el7sso
0:15.0.4-1.redhat_00003.1.el7sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.5::el8
From an advisory covering 5 CVEs
 before 0:15.0.4-1.redhat_00003.1.el8sso
0:15.0.4-1.redhat_00003.1.el8sso
parfait
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:0.5.4-4.module+el8.5.0+728+553fbdb8
0:0.5.4-4.module+el8.5.0+728+553fbdb8
si-units
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:0.6.5-2.module+el8.3.0+214+edf13b3f
0:0.6.5-2.module+el8.3.0+214+edf13b3f
unit-api
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.0-5.module+el8.3.0+214+edf13b3f
0:1.0-5.module+el8.3.0+214+edf13b3f
uom-lib
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.0.1-6.module+el8.3.0+214+edf13b3f
0:1.0.1-6.module+el8.3.0+214+edf13b3f
uom-parent
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.0.3-3.module+el8.3.0+214+edf13b3f
0:1.0.3-3.module+el8.3.0+214+edf13b3f
uom-se
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.0.4-3.module+el8.3.0+214+edf13b3f
0:1.0.4-3.module+el8.3.0+214+edf13b3f
uom-systems
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:0.7-1.module+el8.3.0+214+edf13b3f
0:0.7-1.module+el8.3.0+214+edf13b3f
log4j:log4j
Root:Maven
 before 1.2.12-aikido.2
1.2.12-aikido.21.2.14-aikido.21.2.14-aikido.31.2.14-aikido.41.2.14-aikido.51.2.14-aikido.6
io.root.log4j:log4j
Root:Maven
 before 1.2.12-root.io.1
1.2.12-root.io.11.2.12-root.io.21.2.14-root.io.21.2.14-root.io.31.2.14-root.io.41.2.14-root.io.51.2.14-root.io.6
log4j
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.2.15-26.32.17.1
1.2.15-26.32.17.1
log4j
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.2.15-26.32.17.1
1.2.15-26.32.17.1
storm
SUSE:HPE Helion OpenStack 8
From an advisory covering 2 CVEs
 before 1.2.3-3.8.2
1.2.3-3.8.2
venv-openstack-monasca
SUSE:HPE Helion OpenStack 8
From an advisory covering 2 CVEs
 before 2.2.2~dev1-11.32.1
2.2.2~dev1-11.32.1
storm
SUSE:OpenStack Cloud 8
From an advisory covering 2 CVEs
 before 1.2.3-3.8.2
1.2.3-3.8.2
venv-openstack-monasca
SUSE:OpenStack Cloud 8
From an advisory covering 2 CVEs
 before 2.2.2~dev1-11.32.1
2.2.2~dev1-11.32.1
storm
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 2 CVEs
 before 1.2.3-3.8.2
1.2.3-3.8.2
storm
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 1.2.3-3.5.1
1.2.3-3.5.1
venv-openstack-monasca
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 2.7.1~dev10-3.25.1
2.7.1~dev10-3.25.1
storm
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 1.2.3-3.5.1
1.2.3-3.5.1
log4j
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise Server 15-LTSS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j
SUSE:Enterprise Storage 6
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j12
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 1.2.17-4.3.1
1.2.17-4.3.1
log4j12
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.2.17-4.3.1
1.2.17-4.3.1
log4j12
SUSE:Linux Enterprise Module for Development Tools 15 SP2
 before 1.2.17-4.3.1
1.2.17-4.3.1
log4j12
SUSE:Linux Enterprise Module for Development Tools 15 SP3
 before 1.2.17-4.3.1
1.2.17-4.3.1
log4j
SUSE:HPE Helion OpenStack 8
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:OpenStack Cloud 8
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:OpenStack Cloud 9
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:OpenStack Cloud Crowbar 8
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:OpenStack Cloud Crowbar 9
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server 12 SP5
 before 1.2.15-126.6.1
1.2.15-126.6.1
log4j
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.2.15-126.6.1
1.2.15-126.6.1
elasticsearch
SUSE:OpenStack Cloud 9
 before 2.4.2-6.3.1
2.4.2-6.3.1
kafka
SUSE:OpenStack Cloud 9
 before 0.10.2.2-3.2.1
0.10.2.2-3.2.1
logstash
SUSE:OpenStack Cloud 9
 before 2.4.1-7.3.1
2.4.1-7.3.1
openstack-monasca-agent
SUSE:OpenStack Cloud 9
 before 2.8.2~dev5-3.12.1
2.8.2~dev5-3.12.1
openstack-monasca-persister-java
SUSE:OpenStack Cloud 9
 before 1.12.1~dev9-12.2
1.12.1~dev9-12.2
openstack-monasca-thresh
SUSE:OpenStack Cloud 9
 before 2.1.1-5.3.1
2.1.1-5.3.1
venv-openstack-barbican
SUSE:OpenStack Cloud 9
 before 7.0.1~dev24-3.27.1
7.0.1~dev24-3.27.1
venv-openstack-cinder
SUSE:OpenStack Cloud 9
 before 13.0.10~dev23-3.30.1
13.0.10~dev23-3.30.1
venv-openstack-designate
SUSE:OpenStack Cloud 9
 before 7.0.2~dev2-3.27.1
7.0.2~dev2-3.27.1
venv-openstack-glance
SUSE:OpenStack Cloud 9
 before 17.0.1~dev30-3.25.1
17.0.1~dev30-3.25.1
venv-openstack-heat
SUSE:OpenStack Cloud 9
 before 11.0.4~dev4-3.27.1
11.0.4~dev4-3.27.1
venv-openstack-horizon
SUSE:OpenStack Cloud 9
 before 14.1.1~dev11-4.31.1
14.1.1~dev11-4.31.1
venv-openstack-ironic
SUSE:OpenStack Cloud 9
 before 11.1.5~dev17-4.25.1
11.1.5~dev17-4.25.1
venv-openstack-keystone
SUSE:OpenStack Cloud 9
 before 14.2.1~dev7-3.28.1
14.2.1~dev7-3.28.1
venv-openstack-magnum
SUSE:OpenStack Cloud 9
 before 7.2.1~dev1-4.27.1
7.2.1~dev1-4.27.1
venv-openstack-manila
SUSE:OpenStack Cloud 9
 before 7.4.2~dev60-3.33.1
7.4.2~dev60-3.33.1
venv-openstack-monasca
SUSE:OpenStack Cloud 9
 before 2.7.1~dev10-3.27.1
2.7.1~dev10-3.27.1
venv-openstack-monasca-ceilometer
SUSE:OpenStack Cloud 9
 before 1.8.2~dev3-3.27.1
1.8.2~dev3-3.27.1
venv-openstack-neutron
SUSE:OpenStack Cloud 9
 before 13.0.8~dev164-6.31.1
13.0.8~dev164-6.31.1
venv-openstack-nova
SUSE:OpenStack Cloud 9
 before 18.3.1~dev91-3.31.1
18.3.1~dev91-3.31.1
venv-openstack-octavia
SUSE:OpenStack Cloud 9
 before 3.2.3~dev7-4.27.1
3.2.3~dev7-4.27.1
venv-openstack-sahara
SUSE:OpenStack Cloud 9
 before 9.0.2~dev15-3.27.1
9.0.2~dev15-3.27.1
venv-openstack-swift
SUSE:OpenStack Cloud 9
 before 2.19.2~dev48-2.22.1
2.19.2~dev48-2.22.1
zookeeper
SUSE:OpenStack Cloud 9
 before 3.4.13-3.6.1
3.4.13-3.6.1
elasticsearch
SUSE:OpenStack Cloud Crowbar 9
 before 2.4.2-6.3.1
2.4.2-6.3.1
kafka
SUSE:OpenStack Cloud Crowbar 9
 before 0.10.2.2-3.2.1
0.10.2.2-3.2.1
logstash
SUSE:OpenStack Cloud Crowbar 9
 before 2.4.1-7.3.1
2.4.1-7.3.1
openstack-monasca-agent
SUSE:OpenStack Cloud Crowbar 9
 before 2.8.2~dev5-3.12.1
2.8.2~dev5-3.12.1
openstack-monasca-persister-java
SUSE:OpenStack Cloud Crowbar 9
 before 1.12.1~dev9-12.2
1.12.1~dev9-12.2
openstack-monasca-thresh
SUSE:OpenStack Cloud Crowbar 9
 before 2.1.1-5.3.1
2.1.1-5.3.1
zookeeper
SUSE:OpenStack Cloud Crowbar 9
 before 3.4.13-3.6.1
3.4.13-3.6.1
elasticsearch
SUSE:HPE Helion OpenStack 8
 before 2.4.2-5.3.1
2.4.2-5.3.1
kafka
SUSE:HPE Helion OpenStack 8
 before 0.10.2.2-5.9.1
0.10.2.2-5.9.1
logstash
SUSE:HPE Helion OpenStack 8
 before 2.4.1-5.7.1
2.4.1-5.7.1
openstack-monasca-agent
SUSE:HPE Helion OpenStack 8
 before 2.2.6~dev4-3.21.1
2.2.6~dev4-3.21.1
openstack-monasca-persister-java
SUSE:HPE Helion OpenStack 8
 before 1.7.1~a0~dev2-3.6.1
1.7.1~a0~dev2-3.6.1
openstack-monasca-thresh
SUSE:HPE Helion OpenStack 8
 before 2.1.1-4.3.1
2.1.1-4.3.1
venv-openstack-aodh
SUSE:HPE Helion OpenStack 8
 before 5.1.1~dev7-12.34.1
5.1.1~dev7-12.34.1
venv-openstack-barbican
SUSE:HPE Helion OpenStack 8
 before 5.0.2~dev3-12.35.1
5.0.2~dev3-12.35.1
venv-openstack-ceilometer
SUSE:HPE Helion OpenStack 8
 before 9.0.8~dev7-12.32.1
9.0.8~dev7-12.32.1
venv-openstack-cinder
SUSE:HPE Helion OpenStack 8
 before 11.2.3~dev29-14.36.1
11.2.3~dev29-14.36.1
venv-openstack-designate
SUSE:HPE Helion OpenStack 8
 before 5.0.3~dev7-12.33.1
5.0.3~dev7-12.33.1
venv-openstack-freezer
SUSE:HPE Helion OpenStack 8
 before 5.0.0.0~xrc2~dev2-10.30.1
5.0.0.0~xrc2~dev2-10.30.1
venv-openstack-glance
SUSE:HPE Helion OpenStack 8
 before 15.0.3~dev3-12.33.1
15.0.3~dev3-12.33.1
venv-openstack-heat
SUSE:HPE Helion OpenStack 8
 before 9.0.8~dev22-12.37.1
9.0.8~dev22-12.37.1
venv-openstack-horizon-hpe
SUSE:HPE Helion OpenStack 8
 before 12.0.5~dev6-14.40.1
12.0.5~dev6-14.40.1
venv-openstack-ironic
SUSE:HPE Helion OpenStack 8
 before 9.1.8~dev8-12.35.1
9.1.8~dev8-12.35.1
venv-openstack-keystone
SUSE:HPE Helion OpenStack 8
 before 12.0.4~dev11-11.37.1
12.0.4~dev11-11.37.1
venv-openstack-magnum
SUSE:HPE Helion OpenStack 8
 before 5.0.2_5.0.2_5.0.2~dev31-11.34.1
5.0.2_5.0.2_5.0.2~dev31-11.34.1
venv-openstack-manila
SUSE:HPE Helion OpenStack 8
 before 5.1.1~dev5-12.39.1
5.1.1~dev5-12.39.1
venv-openstack-monasca
SUSE:HPE Helion OpenStack 8
 before 2.2.2~dev1-11.34.1
2.2.2~dev1-11.34.1
venv-openstack-monasca-ceilometer
SUSE:HPE Helion OpenStack 8
 before 1.5.1_1.5.1_1.5.1~dev3-8.30.1
1.5.1_1.5.1_1.5.1~dev3-8.30.1
venv-openstack-murano
SUSE:HPE Helion OpenStack 8
 before 4.0.2~dev2-12.30.1
4.0.2~dev2-12.30.1
venv-openstack-neutron
SUSE:HPE Helion OpenStack 8
 before 11.0.9~dev69-13.40.1
11.0.9~dev69-13.40.1
venv-openstack-nova
SUSE:HPE Helion OpenStack 8
 before 16.1.9~dev92-11.38.1
16.1.9~dev92-11.38.1
venv-openstack-octavia
SUSE:HPE Helion OpenStack 8
 before 1.0.6~dev3-12.35.1
1.0.6~dev3-12.35.1
venv-openstack-sahara
SUSE:HPE Helion OpenStack 8
 before 7.0.5~dev4-11.34.1
7.0.5~dev4-11.34.1
venv-openstack-swift
SUSE:HPE Helion OpenStack 8
 before 2.15.2_2.15.2_2.15.2~dev32-11.25.1
2.15.2_2.15.2_2.15.2~dev32-11.25.1
venv-openstack-trove
SUSE:HPE Helion OpenStack 8
 before 8.0.2~dev2-11.34.1
8.0.2~dev2-11.34.1
zookeeper
SUSE:HPE Helion OpenStack 8
 before 3.4.10-3.9.1
3.4.10-3.9.1
elasticsearch
SUSE:OpenStack Cloud 8
 before 2.4.2-5.3.1
2.4.2-5.3.1
kafka
SUSE:OpenStack Cloud 8
 before 0.10.2.2-5.9.1
0.10.2.2-5.9.1
logstash
SUSE:OpenStack Cloud 8
 before 2.4.1-5.7.1
2.4.1-5.7.1
openstack-monasca-agent
SUSE:OpenStack Cloud 8
 before 2.2.6~dev4-3.21.1
2.2.6~dev4-3.21.1
openstack-monasca-persister-java
SUSE:OpenStack Cloud 8
 before 1.7.1~a0~dev2-3.6.1
1.7.1~a0~dev2-3.6.1
openstack-monasca-thresh
SUSE:OpenStack Cloud 8
 before 2.1.1-4.3.1
2.1.1-4.3.1
venv-openstack-aodh
SUSE:OpenStack Cloud 8
 before 5.1.1~dev7-12.34.1
5.1.1~dev7-12.34.1
venv-openstack-barbican
SUSE:OpenStack Cloud 8
 before 5.0.2~dev3-12.35.1
5.0.2~dev3-12.35.1
venv-openstack-ceilometer
SUSE:OpenStack Cloud 8
 before 9.0.8~dev7-12.32.1
9.0.8~dev7-12.32.1
venv-openstack-cinder
SUSE:OpenStack Cloud 8
 before 11.2.3~dev29-14.36.1
11.2.3~dev29-14.36.1
venv-openstack-designate
SUSE:OpenStack Cloud 8
 before 5.0.3~dev7-12.33.1
5.0.3~dev7-12.33.1
apache-log4j1.2
Ubuntu:Pro:14.04:LTS
 before 1.2.17-4ubuntu3+esm1, plus listed versions
1.2.17-3ubuntu11.2.17-4ubuntu11.2.17-4ubuntu21.2.17-4ubuntu3
1.2.17-4ubuntu3+esm1
apache-log4j1.2
Ubuntu:Pro:16.04:LTS
 before 1.2.17-7ubuntu1+esm1, plus listed versions
1.2.17-6ubuntu11.2.17-7ubuntu1
1.2.17-7ubuntu1+esm1
apache-log4j1.2
Ubuntu:18.04:LTS
 before 1.2.17-8+deb10u1ubuntu0.1, plus listed versions
1.2.17-7ubuntu21.2.17-81.2.17-8+deb10u1build0.18.04.1
1.2.17-8+deb10u1ubuntu0.1
apache-log4j1.2
Ubuntu:20.04:LTS
 before 1.2.17-9ubuntu0.1, plus listed versions
1.2.17-81.2.17-9
1.2.17-9ubuntu0.1
log4j12
openSUSE:Leap 15.2
 before 1.2.17-lp152.3.3.2
1.2.17-lp152.3.3.2
log4j12-mini
openSUSE:Leap 15.2
 before 1.2.17-lp152.3.3.2
1.2.17-lp152.3.3.2
kafka
openSUSE:Leap 15.3
 before 2.1.0-bp153.2.3.1
2.1.0-bp153.2.3.1
kafka-kit
openSUSE:Leap 15.3
 before 2.1.0-bp153.2.3.1
2.1.0-bp153.2.3.1
log4j
openSUSE:Leap 15.3
 before 1.2.17-5.6.1
1.2.17-5.6.1
log4j12
openSUSE:Leap 15.3
 before 1.2.17-4.3.1
1.2.17-4.3.1
kafka
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 2.1.0-bp153.2.6.1
2.1.0-bp153.2.6.1
kafka-kit
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 2.1.0-bp153.2.6.1
2.1.0-bp153.2.6.1
log4j
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.16.0-2.1
2.16.0-2.1
kafka-kit
openSUSE:Tumbleweed
 before 2.1.0-2.1
2.1.0-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubcckuailong/log4shell_1.x2021-12-14
PoC in GitHubopen-AIMS/log4j2022-01-10
PoC in GitHubcuijiung/log4j-CVE-2021-41042025-07-11

History

History
RecordedChangedSources
affected, facts
exploits
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-4104 is a high vulnerability (CVSS 7.5) in Apache Log4j, published December 14, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 80.6%, the 99th percentile. Fixed in log4j 1.2.14-6.4.el6.tuxcare.els1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 406 package rows and 132 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 12 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open