RHSA-2022:5053HighCVSS 9.8

Red Hat Security Advisory: log4j security update

Published
June 15, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2019-17571 →

📋 Description

CVE-2019-17571 — log4j: deserialization of untrusted data in SocketServer

🎯 Affected products18

  • Red Hat Enterprise Linux Server (v. 6 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-0:1.2.14-6.7.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)
  • log4j-debuginfo-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-javadoc-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-javadoc-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-javadoc-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-manual-0:1.2.14-6.7.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-manual-0:1.2.14-6.7.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)
  • log4j-manual-0:1.2.14-6.7.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this: log4j.appender.file.layout=org.apache.log4j.JsonLayout

🔗 References (4)