ID

VAR-201704-1589

CVE

CVE-2017-5645

TITLE

Apache Log4j Vulnerable to unreliable data deserialization

DESCRIPTION

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. Apache Log4j Contains a vulnerability in the deserialization of unreliable data.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. Apache Log4j is a Java-based open source logging tool developed by the Apache Software Foundation. A code issue vulnerability exists in Apache Log4j 2.x versions prior to 2.8.2. An attacker could exploit this vulnerability to execute arbitrary code. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Security Fix(es): * hawtio-osgi (CVE-2017-5645) * prometheus-jmx-exporter: snakeyaml (CVE-2017-18640) * apache-commons-compress (CVE-2019-12402) * karaf-transaction-manager-narayana: netty (CVE-2019-16869, CVE-2019-20445) * tomcat (CVE-2020-1935, CVE-2020-1938, CVE-2020-9484, CVE-2020-13934, CVE-2020-13935, CVE-2020-11996) * spring-cloud-config-server (CVE-2020-5410) * velocity (CVE-2020-13936) * httpclient: apache-httpclient (CVE-2020-13956) * shiro-core: shiro (CVE-2020-17510) * hibernate-core (CVE-2020-25638) * wildfly-openssl (CVE-2020-25644) * jetty (CVE-2020-27216, CVE-2021-28165) * bouncycastle (CVE-2020-28052) * wildfly (CVE-2019-14887, CVE-2020-25640) * resteasy-jaxrs: resteasy (CVE-2020-1695) * camel-olingo4 (CVE-2020-1925) * springframework (CVE-2020-5421) * jsf-impl: Mojarra (CVE-2020-6950) * resteasy (CVE-2020-10688) * hibernate-validator (CVE-2020-10693) * wildfly-elytron (CVE-2020-10714) * undertow (CVE-2020-10719) * activemq (CVE-2020-13920) * cxf-core: cxf (CVE-2020-13954) * fuse-apicurito-operator-container: golang.org/x/text (CVE-2020-14040) * jboss-ejb-client: wildfly (CVE-2020-14297) * xercesimpl: wildfly (CVE-2020-14338) * xnio (CVE-2020-14340) * flink: apache-flink (CVE-2020-17518) * resteasy-client (CVE-2020-25633) * xstream (CVE-2020-26258) * mybatis (CVE-2020-26945) * pdfbox (CVE-2021-27807, CVE-2021-27906) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Installation instructions are available from the Fuse 7.9.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability 1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class 1758619 - CVE-2019-16869 netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers 1764640 - CVE-2019-12402 apache-commons-compress: Infinite loop in name encoding algorithm 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use 1785376 - CVE-2017-18640 snakeyaml: Billion laughs attack via alias feature 1790309 - CVE-2020-1925 olingo-odata: Server side request forgery in AsyncResponseWrapperImpl 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1805006 - CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling 1814974 - CVE-2020-10688 RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack 1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication 1828459 - CVE-2020-10719 undertow: invalid HTTP request with large chunk size 1838332 - CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE 1845626 - CVE-2020-5410 spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack 1851420 - CVE-2020-11996 tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service 1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS 1857040 - CVE-2020-13934 tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS 1860054 - CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl 1860218 - CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS 1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling 1880101 - CVE-2020-13920 activemq: improper authentication allows MITM attack 1881158 - CVE-2020-5421 springframework: RFD protection bypass via jsessionid 1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used 1881637 - CVE-2020-25640 wildfly: resource adapter logs plaintext JMS password at warning level on connection error 1885485 - CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL 1886587 - CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs 1887257 - CVE-2020-26945 mybatis: mishandles deserialization of object streams which could result in remote code execution 1891132 - CVE-2020-27216 jetty: local temporary directory hijacking vulnerability 1898235 - CVE-2020-13954 cxf: XSS via the styleSheetPath 1903727 - CVE-2020-17510 shiro: specially crafted HTTP request may cause an authentication bypass 1908832 - CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling 1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible 1913312 - CVE-2020-17518 apache-flink: directory traversal attack allows remote file writing through the REST API 1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates 1941050 - CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file 1941055 - CVE-2021-27807 pdfbox: infinite loop while loading a crafted PDF file 1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Advisory ID: RHSA-2017:1801-01 Product: Red Hat JBoss Web Server Advisory URL: https://access.redhat.com/errata/RHSA-2017:1801 Issue date: 2017-07-25 CVE Names: CVE-2017-5645 CVE-2017-5647 CVE-2017-5648 CVE-2017-5664 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, x86_64 Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch, x86_64 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. (CVE-2017-5645) * A vulnerability was discovered in tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647) * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664) * A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648) 4. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1441205 - CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used 1441223 - CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object 1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability 1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism 6. JIRA issues fixed (https://issues.jboss.org/): JWS-657 - tomcat-native installs RHEL apr in addition to jbcs-httpd24-httpd-libs JWS-667 - Subject incorrectly removed from user session JWS-695 - tomcat7_t and tomcat8_t domains are in unconfined_domain JWS-709 - RPM missing selinux-policy dependency JWS-716 - Backport 60087 for Tomcat 8 JWS-717 - RFC 7230/3986 url requirement that prevents unencoded curly braces should be optional, since it breaks existing sites JWS-721 - CORS filter Vary header missing JWS-725 - /usr/share/tomcat7 needs world execute permissions to function on openshift v2 JWS-741 - Configurations in conf.d are not applied JWS-760 - [ASF BZ 59961] Provide an option to enable/disable processing of Class-Path entry in a jar's manifest file 7. Package List: Red Hat JBoss Web Server 3.1 for RHEL 6: Source: log4j-eap6-1.2.16-12.redhat_3.1.ep6.el6.src.rpm tomcat-native-1.2.8-10.redhat_10.ep7.el6.src.rpm tomcat7-7.0.70-22.ep7.el6.src.rpm tomcat8-8.0.36-24.ep7.el6.src.rpm i386: tomcat-native-1.2.8-10.redhat_10.ep7.el6.i686.rpm tomcat-native-debuginfo-1.2.8-10.redhat_10.ep7.el6.i686.rpm noarch: log4j-eap6-1.2.16-12.redhat_3.1.ep6.el6.noarch.rpm tomcat7-7.0.70-22.ep7.el6.noarch.rpm tomcat7-admin-webapps-7.0.70-22.ep7.el6.noarch.rpm tomcat7-docs-webapp-7.0.70-22.ep7.el6.noarch.rpm tomcat7-el-2.2-api-7.0.70-22.ep7.el6.noarch.rpm tomcat7-javadoc-7.0.70-22.ep7.el6.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-22.ep7.el6.noarch.rpm tomcat7-jsvc-7.0.70-22.ep7.el6.noarch.rpm tomcat7-lib-7.0.70-22.ep7.el6.noarch.rpm tomcat7-log4j-7.0.70-22.ep7.el6.noarch.rpm tomcat7-selinux-7.0.70-22.ep7.el6.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-22.ep7.el6.noarch.rpm tomcat7-webapps-7.0.70-22.ep7.el6.noarch.rpm tomcat8-8.0.36-24.ep7.el6.noarch.rpm tomcat8-admin-webapps-8.0.36-24.ep7.el6.noarch.rpm tomcat8-docs-webapp-8.0.36-24.ep7.el6.noarch.rpm tomcat8-el-2.2-api-8.0.36-24.ep7.el6.noarch.rpm tomcat8-javadoc-8.0.36-24.ep7.el6.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-24.ep7.el6.noarch.rpm tomcat8-jsvc-8.0.36-24.ep7.el6.noarch.rpm tomcat8-lib-8.0.36-24.ep7.el6.noarch.rpm tomcat8-log4j-8.0.36-24.ep7.el6.noarch.rpm tomcat8-selinux-8.0.36-24.ep7.el6.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-24.ep7.el6.noarch.rpm tomcat8-webapps-8.0.36-24.ep7.el6.noarch.rpm x86_64: tomcat-native-1.2.8-10.redhat_10.ep7.el6.x86_64.rpm tomcat-native-debuginfo-1.2.8-10.redhat_10.ep7.el6.x86_64.rpm Red Hat JBoss Web Server 3.1 for RHEL 7: Source: log4j-eap6-1.2.16-12.redhat_3.1.ep6.el7.src.rpm tomcat-native-1.2.8-10.redhat_10.ep7.el7.src.rpm tomcat7-7.0.70-22.ep7.el7.src.rpm tomcat8-8.0.36-24.ep7.el7.src.rpm noarch: log4j-eap6-1.2.16-12.redhat_3.1.ep6.el7.noarch.rpm tomcat7-7.0.70-22.ep7.el7.noarch.rpm tomcat7-admin-webapps-7.0.70-22.ep7.el7.noarch.rpm tomcat7-docs-webapp-7.0.70-22.ep7.el7.noarch.rpm tomcat7-el-2.2-api-7.0.70-22.ep7.el7.noarch.rpm tomcat7-javadoc-7.0.70-22.ep7.el7.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-22.ep7.el7.noarch.rpm tomcat7-jsvc-7.0.70-22.ep7.el7.noarch.rpm tomcat7-lib-7.0.70-22.ep7.el7.noarch.rpm tomcat7-log4j-7.0.70-22.ep7.el7.noarch.rpm tomcat7-selinux-7.0.70-22.ep7.el7.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-22.ep7.el7.noarch.rpm tomcat7-webapps-7.0.70-22.ep7.el7.noarch.rpm tomcat8-8.0.36-24.ep7.el7.noarch.rpm tomcat8-admin-webapps-8.0.36-24.ep7.el7.noarch.rpm tomcat8-docs-webapp-8.0.36-24.ep7.el7.noarch.rpm tomcat8-el-2.2-api-8.0.36-24.ep7.el7.noarch.rpm tomcat8-javadoc-8.0.36-24.ep7.el7.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-24.ep7.el7.noarch.rpm tomcat8-jsvc-8.0.36-24.ep7.el7.noarch.rpm tomcat8-lib-8.0.36-24.ep7.el7.noarch.rpm tomcat8-log4j-8.0.36-24.ep7.el7.noarch.rpm tomcat8-selinux-8.0.36-24.ep7.el7.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-24.ep7.el7.noarch.rpm tomcat8-webapps-8.0.36-24.ep7.el7.noarch.rpm x86_64: tomcat-native-1.2.8-10.redhat_10.ep7.el7.x86_64.rpm tomcat-native-debuginfo-1.2.8-10.redhat_10.ep7.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2017-5645 https://access.redhat.com/security/cve/CVE-2017-5647 https://access.redhat.com/security/cve/CVE-2017-5648 https://access.redhat.com/security/cve/CVE-2017-5664 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZd3byXlSAg2UNWIIRAtRWAJ9Te0IfpivK9CimMmNplSEKse3isgCePN1K uf6N2qA8ipjhxaVXeCqG0P4= =57v0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat JBoss BPM Suite is a business rules and processes management system for the management, storage, creation, modification, and deployment of JBoss rules and BPMN2-compliant business processes. (CVE-2017-5645) * It was found that XStream contains a vulnerability that allows a maliciously crafted file to be parsed successfully which could cause an application crash. The crash occurs if the file that is being fed into XStream input stream contains an instances of the primitive type 'void'. An attacker could use this flaw to create a denial of service on the target system. (CVE-2017-7957) 3. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. (CVE-2017-7525) Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-7525. The References section of this erratum contains a download link (you must log in to download the update). Description: The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2). (CVE-2017-5645) * A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison. (CVE-2014-9970) * It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information. (CVE-2015-6644) * It was found that while parsing the SAML messages the StaxParserUtil class of Picketlink replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. (CVE-2017-2582) * It was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue(). JIRA issues fixed (https://issues.jboss.org/): JBEAP-11487 - jboss-ec2-eap for EAP 7.0.8 7

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

arbitrary

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-08-08T20:14:46.722000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE