CVE-2022-23307

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

References

Affected packages

Debian:11 / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/debian/apache-log4j1.2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-10+deb11u1

Affected versions

1.*

1.2.17-10

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/debian/apache-log4j1.2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-11

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / apache-log4j1.2

Package

Name: apache-log4j1.2
Purl: pkg:deb/debian/apache-log4j1.2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.17-11

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/apache/logging-log4j2

Affected ranges

Type: GIT
Repo: https://github.com/apache/logging-log4j2
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8d9204a4b4c6016fa6b36513a46502689d6a45c1

Type: GIT
Repo: https://github.com/qos-ch/reload4j
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

527f5374efd3c534b8aae7c133898019182e9f99

Affected versions

v1.*

v1.2.18.0

Other

v1_2_17

v1_2_17_rc3