What is RHSA-2021:5140?

RHSA-2021:5140 is a security advisory published by Red Hat Product Security with Low severity. Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

Which CVE IDs does RHSA-2021:5140 cover?

RHSA-2021:5140 covers the following CVE IDs: CVE-2021-44228, CVE-2021-45046. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2021:5140?

RHSA-2021:5140 has a CVSS v3 base score of 9.8, published by Red Hat Product Security.

Which products are affected by RHSA-2021:5140?

RHSA-2021:5140 affects 200 products, including: Red Hat JBoss Enterprise Application Platform; @babel.code-frame-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform; @babel.core-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform; @babel.generator-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform; @babel.helper-function-name-7.1.0 as a component of Red Hat JBoss Enterprise Application Platform; and others — see the full list on the advisory page.

RHSA-2021:5140: Red Hat Security Advisory: R…

🔗 CVE IDs covered (2)

CVE-2021-44228 →CVE-2021-45046 →

📋 Description

CVE-2021-44228 — log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value CVE-2021-45046 — log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)

🎯 Affected products200

Red Hat JBoss Enterprise Application Platform
@babel.code-frame-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
@babel.core-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
@babel.generator-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
@babel.helper-function-name-7.1.0 as a component of Red Hat JBoss Enterprise Application Platform
@babel.helper-get-function-arity-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
@babel.helper-split-export-declaration-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
@babel.helpers-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
@babel.highlight-7.0.0 as a component of Red Hat JBoss Enterprise Application Platform
@babel.parser-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
@babel.template-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
@babel.traverse-7.4.5 as a component of Red Hat JBoss Enterprise Application Platform
@babel.types-7.4.4 as a component of Red Hat JBoss Enterprise Application Platform
@mrmlnc.readdir-enhanced-2.2.1 as a component of Red Hat JBoss Enterprise Application Platform
@nodelib.fs.stat-1.1.3 as a component of Red Hat JBoss Enterprise Application Platform
@types.c3-0.6.0 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-4.13.0 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-array-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-axis-1.0.10 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-brush-1.0.8 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-chord-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-collection-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-color-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-dispatch-1.0.6 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-drag-1.2.1 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-dsv-1.0.33 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-ease-1.0.7 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-force-1.1.1 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-format-1.3.0 as a component of Red Hat JBoss Enterprise Application Platform
@types.d3-geo-1.10.3 as a component of Red Hat JBoss Enterprise Application Platform
+170 more not shown

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). Workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441 Workaround: For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

🔗 CVE IDs covered (2)

📋 Description

🎯 Affected products200

✅ Remediation

🔗 References (9)