RHSA-2017:2423HighCVSS 9.8

Red Hat Security Advisory: log4j security update

Published
August 7, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2017-5645 →CVE-2019-17571 →

📋 Description

CVE-2017-5645 — log4j: Socket receiver deserialization vulnerability CVE-2019-17571 — log4j: deserialization of untrusted data in SocketServer

🎯 Affected products24

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client (v. 7)
  • log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • log4j-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • log4j-0:1.2.17-16.el7_4.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • log4j-javadoc-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)
  • log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • log4j-manual-0:1.2.17-16.el7_4.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this: log4j.appender.file.layout=org.apache.log4j.JsonLayout

🔗 References (4)