{"id":"CVE-2020-9493","aliases":["CLSA-2025-1751328204","CLSA-2026-1778114668","CLSA-2026-1787931543","CLSA-2026-1790602996","CLSA-2026-1791960488","CLSA-2026-1794273742","EUVD-2020-30300","GHSA-prp9-9gxw-38j8"],"status":"published","title":"Java deserialization in Chainsaw","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04612,"percentile":0.91795,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2021-06-16T07:30:11Z","modified":"2026-11-10T07:15:02Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"log4j:log4j","fixed_in":["1.2.15-tuxcare.2","1.2.12-tuxcare.2","1.2.13-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.17"},{"fixed":"1.2.17.tuxcare.1"}]}],"versions":["1.2.17"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.16"},{"fixed":"1.2.16-tuxcare.1"}]}],"versions":["1.2.16"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.15"},{"fixed":"1.2.15-tuxcare.2"}]}],"versions":["1.2.15","1.2.15-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.12"},{"fixed":"1.2.12-tuxcare.2"}]}],"versions":["1.2.12","1.2.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.13"},{"fixed":"1.2.13-tuxcare.2"}]}],"versions":["1.2.13","1.2.13-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"log4j:log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.14"},{"fixed":"1.2.14-tuxcare.3"}]}],"versions":["1.2.14","1.2.14-tuxcare.1","1.2.14-tuxcare.2"],"bundled":3}],"products":[{"vendor":"apache","product":"chainsaw"},{"vendor":"apache","product":"log4j"},{"vendor":"apache software foundation","product":"apache chainsaw"},{"vendor":"qos","product":"reload4j"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2021/06/16/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Tool Signature","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/06/16/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/18/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9493"},{"url":"https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83@%3Cannounce.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-prp9-9gxw-38j8"}],"sources":{"cve":[{"id":"CVE-2020-9493","title":"Java deserialization in Chainsaw","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","status":"published","published":"2021-06-16T07:30:11Z","modified":"2026-10-07T16:00:37.877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502","CWE-502"],"updated_at":"2026-11-02T14:35:49.538427Z"}],"euvd":[{"id":"EUVD-2020-30300","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","status":"published","published":"2021-06-16T07:30:11Z","modified":"2026-10-07T16:00:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:35.164729Z"}],"ghsa":[{"id":"GHSA-prp9-9gxw-38j8","title":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to...","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","status":"published","published":"2022-05-24T19:05:32Z","modified":"2023-01-29T05:06:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:46:03.455343Z"}],"nvd":[{"id":"CVE-2020-9493","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","status":"published","published":"2021-06-16T08:15:06.577Z","modified":"2026-10-07T16:17:30.13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:43.288951Z"}],"osv":[{"id":"CVE-2020-9493","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","status":"published","published":"2021-06-16T08:15:06.577Z","modified":"2026-10-24T14:24:39.655033502Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"CLSA-2025-1751328204","title":"TuxCare security update for log4j:log4j (6 CVEs)","description":"TuxCare rebuilt log4j:log4j to address 6 CVEs. Fixed in 1.2.17.tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-10-15T09:45:06.561316005Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1778114668","title":"TuxCare security update for log4j:log4j (5 CVEs)","description":"TuxCare rebuilt log4j:log4j to address 5 CVEs. Fixed in 1.2.16-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:46:30.577023091Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1787931543","title":"TuxCare security update for log4j:log4j (1 CVE)","description":"TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.15-tuxcare.2.","status":"published","published":"2026-08-28T15:39:03Z","modified":"2026-10-15T09:46:49.389568383Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790602996","title":"TuxCare security update for log4j:log4j (1 CVE)","description":"TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.12-tuxcare.2.","status":"published","published":"2026-09-28T13:43:16Z","modified":"2026-10-15T09:47:44.84692828Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791960488","title":"TuxCare security update for log4j:log4j (1 CVE)","description":"TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.13-tuxcare.2.","status":"published","published":"2026-10-14T06:48:08Z","modified":"2026-10-15T09:45:52.727993509Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1794273742","title":"TuxCare security update for log4j:log4j (3 CVEs)","description":"TuxCare rebuilt log4j:log4j to address 3 CVEs. Fixed in 1.2.14-tuxcare.3.","status":"published","published":"2026-11-10T02:22:23Z","modified":"2026-11-10T07:15:02.338065082Z","updated_at":"2026-11-10T07:24:16.839298Z"}]}}