By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Log4j | Apache | 1.2 (including) | 1.2.17 (including) |
EAP 6.4.24 release | RedHat | * | |
EAP 6.4 log4j async | RedHat | log4j | * |
EAP 7.4.4 release | RedHat | log4j | * |
EAP 7.4 log4j async | RedHat | log4j | * |
Red Hat AMQ Streams 1.6.7 | RedHat | * | |
Red Hat AMQ Streams 2.0.1 | RedHat | log4j | * |
Red Hat Data Grid 7.3.9 | RedHat | log4j | * |
Red Hat Enterprise Linux 6 Extended Lifecycle Support | RedHat | log4j-0:1.2.14-6.6.el6_10 | * |
Red Hat Enterprise Linux 7 | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.3 Advanced Update Support | RedHat | log4j-0:1.2.17-17.el7_3 | * |
Red Hat Enterprise Linux 7.4 Advanced Update Support | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.6 Advanced Update Support | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.6 Telco Extended Update Support | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.7 Advanced Update Support | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.7 Telco Extended Update Support | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions | RedHat | log4j-0:1.2.17-18.el7_4 | * |
Red Hat Enterprise Linux 8 | RedHat | parfait:0.5-8050020220124063900.6b489b78 | * |
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | RedHat | parfait:0.5-8010020220124232535.d5701770 | * |
Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | parfait:0.5-8020020220124231008.1c5d4e8a | * |
Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | parfait:0.5-8040020220124230039.d304d9ed | * |
Red Hat Fuse 7.10.1 | RedHat | log4j | * |
Red Hat Fuse/AMQ 6.3.20 | RedHat | log4j | * |
Red Hat Fuse/AMQ 6.3.20 | RedHat | log4j | * |
Red Hat JBoss Data Virtualization 6.4.8.SP1 | RedHat | log4j | * |
Red Hat JBoss Data Virtualization 6.4.8.SP2 | RedHat | log4j | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | log4j-eap6-0:1.2.17-3.redhat_00008.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | log4j-jboss-logmanager-0:1.1.4-3.Final_redhat_00002.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-bundles-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-cli-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-client-all-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-clustering-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-cmp-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-connector-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-controller-client-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-core-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-core-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-deployment-repository-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-deployment-scanner-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-domain-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-domain-http-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-domain-management-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-ee-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-ee-deployment-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-ejb3-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-embedded-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-host-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jacorb-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-javadocs-0:7.5.24-1.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jaxr-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jaxrs-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jdr-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jpa-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jsf-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-jsr77-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-logging-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-mail-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-management-client-content-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-messaging-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-modcluster-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-modules-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-naming-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-network-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-osgi-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-osgi-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-osgi-service-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-picketlink-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-platform-mbean-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-pojo-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-process-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-product-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-protocol-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-remoting-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-sar-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-server-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-standalone-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-system-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-threads-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-transactions-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-version-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-web-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-webservices-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossas-welcome-content-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-weld-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jboss-as-xts-0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossts-1:4.17.45-2.Final_redhat_2.1.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbossweb-0:7.5.32-2.Final_redhat_1.2.ep6.el6 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | log4j-eap6-0:1.2.17-3.redhat_00008.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | log4j-jboss-logmanager-0:1.1.4-3.Final_redhat_00002.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-bundles-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-cli-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-client-all-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-clustering-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-cmp-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-connector-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-controller-client-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-core-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-core-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-deployment-repository-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-deployment-scanner-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-domain-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-domain-http-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-domain-management-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-ee-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-ee-deployment-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-ejb3-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-embedded-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-host-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jacorb-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-javadocs-0:7.5.24-1.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jaxr-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jaxrs-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jdr-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jpa-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jsf-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-jsr77-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-logging-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-mail-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-management-client-content-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-messaging-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-modcluster-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-modules-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-naming-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-network-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-osgi-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-osgi-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-osgi-service-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-picketlink-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-platform-mbean-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-pojo-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-process-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-product-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-protocol-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-remoting-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-sar-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-server-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-standalone-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-system-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-threads-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-transactions-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-version-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-web-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-webservices-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossas-welcome-content-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-weld-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jboss-as-xts-0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossts-1:4.17.45-2.Final_redhat_2.1.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbossweb-0:7.5.32-2.Final_redhat_1.2.ep6.el7 | * |
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | RedHat | eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.ep7.el7 | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.el8eap | * |
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-log4j-0:2.17.1-1.redhat_00001.1.el8eap | * |
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.el7eap | * |
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-log4j-0:2.17.1-1.redhat_00001.1.el7eap | * |
Red Hat JBoss Web Server 3.1 | RedHat | log4j-eap6 | * |
Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | log4j-eap6-0:1.2.17-3.redhat_00008.1.ep6.el7 | * |
Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat7-0:7.0.70-46.ep7.el7 | * |
Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat8-0:8.0.36-49.ep7.el7 | * |
Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat-native-0:1.2.23-26.redhat_26.ep7.el7 | * |
Red Hat Single Sign-On 7.4.10 | RedHat | log4j | * |
Red Hat Single Sign-On 7.5 for RHEL 7 | RedHat | rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el7sso | * |
Red Hat Single Sign-On 7.5 for RHEL 8 | RedHat | rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el8sso | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-maven36-log4j12-0:1.2.17-23.4.el7 | * |
Red Hat Virtualization Engine 4.4 | RedHat | org.ovirt.engine-root-0:4.4.10.6-1 | * |
Red Hat Virtualization Engine 4.4 | RedHat | snmp4j-0:3.6.4-0.1.el8ev | * |
RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso74-openshift-rhel8:7.4-45 | * |
RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso74-openj9-openshift-rhel8:7.4-60 | * |
RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso75-openshift-rhel8:7.5-17 | * |
RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso7-rhel8-operator-bundle:7.5.1-9 | * |
RHSSO 7.5.1 | RedHat | log4j | * |
Apache-log4j1.2 | Ubuntu | bionic | * |
Apache-log4j1.2 | Ubuntu | esm-apps/xenial | * |
Apache-log4j1.2 | Ubuntu | focal | * |
Apache-log4j1.2 | Ubuntu | impish | * |
Apache-log4j1.2 | Ubuntu | lunar | * |
Apache-log4j1.2 | Ubuntu | mantic | * |
Apache-log4j1.2 | Ubuntu | trusty | * |
Apache-log4j1.2 | Ubuntu | xenial | * |
Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. This can be used to alter query logic to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or product package with even a minimal user base is likely to be subject to an attempted attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.